RHSA-2026:76041

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiato…

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

vLLM is an inference and serving engine for large language models.

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so…

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying…

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

Out-of-bounds Read vulnerability in Apache Thrift.

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.