Red Hat Security AdvisoryRHSA-2026:90440
Red Hat Enterprise Linux AI 3.4.6 security update
Released 2026-10-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Fixes 12 records
Priority HIGH 77
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00544 · Published 2026-09-18 · Partial fix · 0.28.0 CWE-129
Priority HIGH 73
fsspec is a specification and Python implementation framework for filesystem interfaces.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00475 · Published 2026-10-02 · Partial fix · 2026.6.0 CWE-1336
Priority MEDIUM 64
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality…
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00808 · Published 2026-09-26 · Partial fix · 0.29.0 CWE-400
Priority MEDIUM 63
Multidict is an implementation of a multidict data structure.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00448 · Published 2026-10-02 · Partial fix · 6.9.1 CWE-401
Priority MEDIUM 40
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00727 · Published 2026-08-28 · Partial fix CWE-400
Priority LOW 38
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00335 · Published 2026-09-29 · Partial fix · 2.8.0 CWE-770
Priority LOW 36
urllib3 is an HTTP client library for Python.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00292 · Published 2026-09-29 · Partial fix · 2.8.0 CWE-835
Priority LOW 36
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.0045 · Published 2026-08-20 · Partial fix CWE-502
Priority LOW 35
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00206 · Published 2026-09-29 · Partial fix · 2.8.0 CWE-295
Priority LOW 34
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0037 · Published 2026-09-29 · Partial fix · 3.1.9 CWE-67
Priority LOW 34
PyJWT is a Python implementation of JSON Web Token standards.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00175 · Published 2026-09-28 · Partial fix · 2.14.0 CWE-347
Priority LOW 32
vLLM is a library for LLM inference and serving.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2026-07-06 · Partial fix · 0.24.0 CWE-617
THREATIST.IORead the docs