RHSA-2026:61627

Ray is an AI compute engine.

vLLM is an inference and serving engine for large language models (LLMs).

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.

Pillow is a Python imaging library.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

urllib3 is a user-friendly HTTP client library for Python.

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so…

Pillow is a Python imaging library.

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declar…

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying…

Starlette is a lightweight ASGI framework/toolkit.

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

vLLM is an inference and serving engine for large language models (LLMs).

vLLM is an inference and serving engine for large language models (LLMs).

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation.

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

runc is a CLI tool for spawning and running containers according to the OCI specification.

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation.

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memor…

vLLM is an inference and serving engine for large language models (LLMs).

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.