Red Hat Security Advisory

RHSA-2026:94715

Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA)

Released 2026-11-03 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9

Fixes 48 records

TI-2026-76627 CVE-2026-112896 · GHSA-pchr-8j38-3x4p

Out-of-bounds read in Pillow TIFF encoder ColorMap handling

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00475 Published 2026-10-19 Partial fix · 13.0.0 CWE-125

TI-2026-76625 CVE-2026-112894 · GHSA-jg86-v3jv-hrpm

Quadratic-time denial of service in Pillow PDF save_all

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76605 CVE-2026-112405 · GHSA-cp9v-662q-vvx9

NULL pointer dereference in Pillow's Image.merge function

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76604 CVE-2026-112404 · GHSA-c6hw-5grf-ff96

Out-of-bounds read in Pillow TIFF decoding leaks heap memory

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00444 Published 2026-10-19 Partial fix · 13.0.0 CWE-126

TI-2026-76602 CVE-2026-112402 · GHSA-7mwm-ghpf-9vrm

Double free in Pillow ImagingScaleAffine on allocation failure

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-416

TI-2026-76600 CVE-2026-112400 · GHSA-65qm-jvmh-6pqg

GIF seek in Pillow keeps rejected size, allowing denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-400

TI-2026-76599 CVE-2026-112399 · GHSA-5xm2-6676-qcp9

Excessive memory use in Pillow APNG handling enables denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00529 Published 2026-10-19 Partial fix · 13.0.0 CWE-789

TI-2026-76597 CVE-2026-112397 · GHSA-58r4-6rv3-gfh8

Out-of-bounds memory access in Pillow morphology on zero-width images

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00573 Published 2026-10-19 Partial fix · 13.0.0 CWE-787

TI-2026-79005 CVE-2026-96640 · GHSA-mrfp-p49p-3hf2

Resource exhaustion in Pillow PDF append via malformed page tree

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00604 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-76624 CVE-2026-112893 · GHSA-j4m9-6w36-pw47

Invalid free in Pillow FreeType rendering when a stroker is active

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76603 CVE-2026-112403 · GHSA-8g5g-8vmr-9782

Heap buffer overflow in Pillow JPEG decoder

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00945 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76598 CVE-2026-112398 · GHSA-5x8w-8jj5-q52h

Heap buffer overflow in Pillow FlashPix JPEG decoding

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00696 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76595 CVE-2026-112395 · GHSA-462x-pgg6-55fp

Pillow tiled-TIFF decoder reads past tile buffer

HIGH 75

Pillow is a Python imaging library.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00514 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76593 CVE-2026-112393 · GHSA-332p-7hrc-92wf

Pillow heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01019 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76592 CVE-2026-112392 · GHSA-27h8-gf7j-v5hc

NULL dereference in Pillow rank filters crashes on zero-size images

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00593 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76590 CVE-2026-112390 · GHSA-22hg-r758-rrw9

Infinite loop in Pillow MIC frame counting with embedded TIFF

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00593 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

TI-2026-76628 CVE-2026-112897 · GHSA-q45j-58j2-45rg

Pillow returns uninitialized memory as TIFF pixels

HIGH 71

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00479 Published 2026-10-19 Partial fix · 13.0.0 CWE-908

TI-2026-76629 CVE-2026-112898 · GHSA-rfgq-q3w2-pmv2

Information disclosure in Pillow Image.quantize() via empty palette

HIGH 70

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-79011 CVE-2026-114501 · GHSA-654x-cwwv-5j9c

Pillow Arrow export leaks stale heap memory when alignment is set

HIGH 67

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0037 Published 2026-10-21 Partial fix · 13.0.0 CWE-226

TI-2026-76594 CVE-2026-112394 · GHSA-4558-3h8r-v8xp

Out-of-bounds read in Pillow P;2L and P;4L raw decoders

HIGH 67

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00555 Published 2026-10-19 Partial fix · 13.0.0 CWE-126

TI-2026-78997 CVE-2026-96644 · GHSA-9v9v-9qvf-h2hj

Heap over-read in Pillow WMF and EMF rendering on Windows

MEDIUM 64

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00384 Published 2026-10-21 Partial fix · 13.0.0 CWE-125

TI-2026-78993 CVE-2026-96642 · GHSA-3j72-p6qg-6xp7

Infinite CPU loop in Pillow TarIO with negative member size

MEDIUM 64

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-835

TI-2026-76862 CVE-2026-112940 · GHSA-v4x8-3wr5-3wq8

Symlink race in filelock ReadWriteLock lets attackers overwrite files

MEDIUM 64

filelock is a platform-independent file lock for Python.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.0019 Published 2026-10-20 Partial fix · 4.2.1 CWE-363

TI-2026-79002 CVE-2026-96636 · GHSA-p8hx-v2p6-rp84

Pillow decompression-bomb check bypassed by multi-frame seek()

MEDIUM 62

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-78992 CVE-2026-96641 · GHSA-4rm8-3hmm-39fg

Integer overflow in Pillow font width calculation

MEDIUM 62

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-190

TI-2026-79004 CVE-2026-96639 · GHSA-v9pv-5gc8-w2m6

Pillow multi-frame loaders reuse stale native image storage

MEDIUM 50

Pillow is a Python imaging library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2026-10-21 Partial fix · 13.0.0 CWE-125

TI-2026-76630 CVE-2026-112900 · GHSA-w889-685w-c8fh

Argument injection in Pillow Ghostscript call can run commands

MEDIUM 50

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01303 Published 2026-10-19 Partial fix · 13.0.0 CWE-78

TI-2026-76626 CVE-2026-112895 · GHSA-p4wg-p73j-c528

Uncontrolled recursion in Pillow PDF parser causes denial of service

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-674

TI-2026-76606 CVE-2026-112406 · GHSA-f2g6-542v-9j58

Infinite loop in Pillow PdfParser.rewrite_pages on cyclic page tree

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00573 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

TI-2026-76527 CVE-2026-111064 · GHSA-5wr8-gcqf-gqf3

Missing initial request timeout in aiohttp server

MEDIUM 42

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00399 Published 2026-10-19 Partial fix · 3.14.4 CWE-770

TI-2026-76623 CVE-2026-112892 · GHSA-gg2r-wvfm-q9rx

Unbounded memory expansion in Pillow MSP RLE decoder

LOW 38

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00503 Published 2026-10-19 Partial fix · 13.0.0 CWE-409

TI-2026-85664 CVE-2026-112902

Memory disclosure in Pillow libtiff TIFF encoder via crafted tags

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00495 Published 2026-11-05 Partial fix · 13.0.0 CWE-686

TI-2026-79003 CVE-2026-96637 · GHSA-g842-9rc4-69pw

Decompression bomb check bypass in Pillow allows memory exhaustion

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00373 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-78996 CVE-2026-96643 · GHSA-g4qv-2jxx-769h

Pillow PNG eXIf chunk makes EXIF parsing run in quadratic time

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00373 Published 2026-10-21 Partial fix · 13.0.0 CWE-407

TI-2026-76631 CVE-2026-112901 · GHSA-xgh8-jp6q-p5x8

Regular expression denial of service in Pillow XBM image parser

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00532 Published 2026-10-19 Partial fix · 13.0.0 CWE-1333

TI-2026-76622 CVE-2026-112891 · GHSA-fc9g-5qg7-mf45

Quadratic GIF comment copying in Pillow slows GIF saving

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76601 CVE-2026-112401 · GHSA-74r2-7ff9-mjj2

Quadratic GIF comment handling in Pillow allows denial of service

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00649 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76528 CVE-2026-111065 · GHSA-6cjc-53gc-5rqm

Connector pool exhaustion in AIOHTTP via Max-Age overflow

LOW 37

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00395 Published 2026-10-19 Partial fix · 3.14.4 CWE-770

TI-2026-78998 CVE-2026-96778 · GHSA-g7cr-3p24-7wf7

Heap buffer overflow in Pillow JPEG encoder when writing comments

LOW 36

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00454 Published 2026-10-21 Partial fix · 13.0.0 CWE-787

TI-2026-76529 CVE-2026-111066 · GHSA-9xw5-w5jj-pvcg

File descriptor exhaustion in AIOHTTP multipart request processing

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00412 Published 2026-10-19 Partial fix · 3.14.4 CWE-400

TI-2026-76526 CVE-2026-111063 · GHSA-494j-54xm-rwp3

AIOHTTP does not enforce the Secure attribute on shared cookies

LOW 36

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00233 Published 2026-10-19 Partial fix · 3.14.4 CWE-1004

TI-2026-76596 CVE-2026-112396 · GHSA-4rr5-89j8-mwwm

Heap use-after-free in Pillow TIFF encoding to in-memory buffer

LOW 34

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00694 Published 2026-10-19 Partial fix · 13.0.0 CWE-416

TI-2026-76532 CVE-2026-111750 · GHSA-pqxq-w44r-73xw

Request smuggling in aiohttp pure-Python HTTP parser

LOW 34

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00382 Published 2026-10-19 Partial fix · 3.14.4 CWE-444

TI-2026-79000 CVE-2026-114406 · GHSA-jrx5-4fv3-4mcq

Red Hat system CA store trusts weak eMudhra intermediate certificates

LOW 32

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak pr…

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.0031 Published 2026-10-21 Partial fix · 2026.2.92_v9.0.319-100.3.el10_2, 2026.2.92_v9.0.319-100.3.el10_0 +138 CWE-295

TI-2026-85661 CVE-2026-112899

Pillow EPS scale rendering bypasses decompression bomb limit

LOW 29

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00538 Published 2026-11-05 Partial fix · 13.0.0 CWE-770

TI-2026-78991 CVE-2026-96638 · GHSA-24rc-8hj2-v98c

Memory exhaustion in Pillow BMP RLE decoder enables denial of service

LOW 29

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-76591 CVE-2026-112391 · GHSA-254f-3936-288h

Unbounded recursion in Pillow PdfParser lets attackers crash workers

LOW 29

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00581 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

TI-2026-76530 CVE-2026-111748 · GHSA-f9xw-jh8m-3mwq

Absolute-form request targets can spoof Request.scheme in AIOHTTP

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00386 Published 2026-10-19 Partial fix · 3.14.4 CWE-807