RHSA-2026:4128

Vulnerability from csaf_redhat - Published: 2026-03-09 18:59 - Updated: 2026-03-09 19:02
Summary
Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)

Notes

Topic
Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA) is now available.
Details
Red Hat® AI Inference Server Model Optimization Tools
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Inference Server Model Optimization Tools",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:4128",
        "url": "https://access.redhat.com/errata/RHSA-2026:4128"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2020-23922",
        "url": "https://access.redhat.com/security/cve/CVE-2020-23922"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2022-32189",
        "url": "https://access.redhat.com/security/cve/CVE-2022-32189"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2022-32296",
        "url": "https://access.redhat.com/security/cve/CVE-2022-32296"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-39327",
        "url": "https://access.redhat.com/security/cve/CVE-2023-39327"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-39329",
        "url": "https://access.redhat.com/security/cve/CVE-2023-39329"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-6349",
        "url": "https://access.redhat.com/security/cve/CVE-2023-6349"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-45341",
        "url": "https://access.redhat.com/security/cve/CVE-2024-45341"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-50613",
        "url": "https://access.redhat.com/security/cve/CVE-2024-50613"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25990",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25990"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4128.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)",
    "tracking": {
      "current_release_date": "2026-03-09T19:02:08+00:00",
      "generator": {
        "date": "2026-03-09T19:02:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.2"
        }
      },
      "id": "RHSA-2026:4128",
      "initial_release_date": "2026-03-09T18:59:37+00:00",
      "revision_history": [
        {
          "date": "2026-03-09T18:59:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-09T18:59:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-09T19:02:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.2",
                "product": {
                  "name": "Red Hat AI Inference Server 3.2",
                  "product_id": "Red Hat AI Inference Server 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
                  "product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3A2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1772713830"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64",
                  "product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3A9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1772713830"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64 as a component of Red Hat AI Inference Server 3.2",
          "product_id": "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64"
        },
        "product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64 as a component of Red Hat AI Inference Server 3.2",
          "product_id": "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        },
        "product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-23922",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2020-08-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1953004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in giflib. A missing check in function DumpScreen2RGB in gif2rgb.c leads to an out-of-bounds read, allowing an attacker to crash the gif2rgb tool. The issue is not in the giflib library, but in the gif2rgb utility program.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "giflib: out-of-bounds read in DumpScreen2RGB() in gif2rgb.c in gif2rgb tool",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect the versions of giflib as shipped with Red Hat Enterprise Linux 8 as they did not include the gif2rgb tool.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-23922"
        },
        {
          "category": "external",
          "summary": "RHBZ#1953004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1953004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-23922",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-23922"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-23922",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23922"
        }
      ],
      "release_date": "2021-04-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "giflib: out-of-bounds read in DumpScreen2RGB() in gif2rgb.c in gif2rgb tool"
    },
    {
      "cve": "CVE-2022-32189",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2022-08-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2113814"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to create a denial of service, impacting availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw stems from a particular and specific method (GoBDecode) which isn\u0027t commonly used. There are few components within Red Hat offerings which call this function. In rare cases where this method is called, the component limits possible damage or it is not possible to be triggered by an attacker. For these combined reasons the impact has been downgraded to Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-32189"
        },
        {
          "category": "external",
          "summary": "RHBZ#2113814",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2113814"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32189",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-32189"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32189",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32189"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/53871",
          "url": "https://go.dev/issue/53871"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU",
          "url": "https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU"
        }
      ],
      "release_date": "2022-08-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service"
    },
    {
      "cve": "CVE-2022-32296",
      "cwe": {
        "id": "CWE-341",
        "name": "Predictable from Observable State"
      },
      "discovery_date": "2022-06-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2096901"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 (\"Double-Hash Port Selection Algorithm\") of RFC 6056.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: insufficient TCP source port randomness leads to client identification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw was found to be a duplicate of CVE-2022-1012. Please see https://access.redhat.com/security/cve/CVE-2022-1012 for information about affected products and security errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-32296"
        },
        {
          "category": "external",
          "summary": "RHBZ#2096901",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2096901"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32296",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-32296"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32296",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32296"
        }
      ],
      "release_date": "2022-05-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 0.0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "title": "kernel: insufficient TCP source port randomness leads to client identification"
    },
    {
      "cve": "CVE-2023-6349",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2024-05-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2283553"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libvpx. Encoding a frame with larger dimensions than the original configured size with VP9 may result in a heap overflow.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libvpx: Heap buffer overflow related to VP9 encoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability does not affect any versions of Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-6349"
        },
        {
          "category": "external",
          "summary": "RHBZ#2283553",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283553"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6349",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-6349"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6349",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6349"
        }
      ],
      "release_date": "2024-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libvpx: Heap buffer overflow related to VP9 encoding"
    },
    {
      "cve": "CVE-2023-39327",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-07-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295812"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjpeg: Malicious files can cause the program to enter a large loop",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-39327"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295812",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295812"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-39327",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39327"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39327",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39327"
        }
      ],
      "release_date": "2024-07-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjpeg: Malicious files can cause the program to enter a large loop"
    },
    {
      "cve": "CVE-2023-39329",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-07-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295816"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjpeg: Resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-39329"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295816",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295816"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-39329",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39329"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39329",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39329"
        }
      ],
      "release_date": "2024-07-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjpeg: Resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c"
    },
    {
      "cve": "CVE-2024-45341",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2025-01-23T12:26:31.454000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2341750"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this issue only affects users of private PKIs that make use of URIs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2341750",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2341750"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45341"
        }
      ],
      "release_date": "2025-01-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints"
    },
    {
      "cve": "CVE-2024-50613",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2024-10-27T23:00:45.399703+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2322056"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the libsndfile package. A specially-crafted input file may trigger a reachable assertion error, which can cause an application crash leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsndfile: Reachable assertion in mpeg_l3_encoder_close",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-50613"
        },
        {
          "category": "external",
          "summary": "RHBZ#2322056",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322056"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-50613",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-50613"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-50613",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50613"
        },
        {
          "category": "external",
          "summary": "https://github.com/libsndfile/libsndfile/issues/1034",
          "url": "https://github.com/libsndfile/libsndfile/issues/1034"
        }
      ],
      "release_date": "2024-10-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsndfile: Reachable assertion in mpeg_l3_encoder_close"
    },
    {
      "cve": "CVE-2026-25990",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-02-11T21:05:39.535631+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2439170"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2439170",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439170"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25990"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa",
          "url": "https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"
        }
      ],
      "release_date": "2026-02-11T20:53:52.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-09T18:59:37+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:4128",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4128"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:2fd4f343235f7e896a70169fc4b856343d639c65bec77c1883cbd8210caf3a92_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:9c1beb862965c37ec54cbc5e5f2352ba83b3f377ce5c2a9909b943081abb55ac_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.