RHSA-2026:74674
Vulnerability from csaf_redhat - Published: 2026-10-01 20:54 - Updated: 2026-10-02 17:42Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.4.3 (Neuron)
Severity
Important
Notes
Topic: Red Hat AI Base Images 3.4.3 (Neuron) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.
5.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
CWE-121 - Stack-based Buffer OverflowAffected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
5.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.
5.6 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
6.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
CWE-208 - Observable Timing DiscrepancyAffected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A flaw was found in glibc (GNU C Library). This vulnerability occurs when an application uses the `scanf` family of functions with a `%mc` format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination can lead to a one-byte heap buffer overflow, potentially allowing an attacker to corrupt memory.
5.0 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.
8.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.
8.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in giflib. A remote attacker can exploit a buffer overflow vulnerability in the EGifGCBToExtension function by providing a specially crafted Graphics Control Extension (GCE) block. This allows overwriting an existing GCE block without proper size validation, leading to a denial of service (DoS) on the system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or further system compromise.
4.1 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the '%' character in `ssh_config`.
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A flaw was found in OpenSSH. This vulnerability allows the system to use unintended Elliptic Curve Digital Signature Algorithm (ECDSA) algorithms. This occurs because the configuration for accepted public key algorithms is misinterpreted, leading to the use of weaker cryptographic methods than intended. This could potentially allow an attacker to compromise the confidentiality of data.
CWE-115 - Misinterpretation of InputAffected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A flaw was found in OpenSSH. This vulnerability allows for a low integrity impact due to the omission of connection multiplexing confirmation for proxy-mode multiplexing sessions. A local user, under specific and complex conditions requiring user interaction, could potentially establish a multiplexed session without explicit confirmation, leading to unintended data handling.
CWE-306 - Missing Authentication for Critical FunctionAffected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A flaw was found in OpenSSH. This vulnerability arises from the incorrect handling of the authorized_keys principals option in uncommon scenarios. Specifically, when a principals list is used with a Certificate Authority that includes comma characters, OpenSSH may misinterpret the input. This could lead to security bypasses, potentially allowing unintended access or information disclosure in specific authentication contexts.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer underflow and an out-of-bounds read vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can lead to a heap out-of-bounds write, potentially allowing a remote attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.
6.6 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in OpenEXR. A remote attacker could exploit a vulnerability in the IDManifest::init() function when processing specially crafted EXR files. The function attempts to reconstruct strings from a prefix-compressed representation. If a previous string exceeds 255 bytes, the subsequent string is expected to have a 2-byte prefix length. However, the code reads these bytes without validating that the current string has at least two bytes, which could lead to information disclosure or a denial of service (DoS).
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape() without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current user.
7.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user's system.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Linux-PAM's `pam_userdb` module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the `pam_userdb` module is configured to store and compare credentials in plaintext, which is not a default setting.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and cause a denial of service.
8.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.
4.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg's VobSub demuxer. This could allow an attacker to take control of the affected system.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A vulnerability in Vim's shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
References
581 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Base Images 3.4.3 (Neuron) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Base Images",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:74674",
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-52355",
"url": "https://access.redhat.com/security/cve/CVE-2023-52355"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-34459",
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-10911",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14087",
"url": "https://access.redhat.com/security/cve/CVE-2025-14087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14512",
"url": "https://access.redhat.com/security/cve/CVE-2025-14512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-6170",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10118",
"url": "https://access.redhat.com/security/cve/CVE-2026-10118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11822",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11824",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11940",
"url": "https://access.redhat.com/security/cve/CVE-2026-11940"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12912",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14164",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15308",
"url": "https://access.redhat.com/security/cve/CVE-2026-15308"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15588",
"url": "https://access.redhat.com/security/cve/CVE-2026-15588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16118",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26740",
"url": "https://access.redhat.com/security/cve/CVE-2026-26740"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29111",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33416",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33636",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33845",
"url": "https://access.redhat.com/security/cve/CVE-2026-33845"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33846",
"url": "https://access.redhat.com/security/cve/CVE-2026-33846"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34588",
"url": "https://access.redhat.com/security/cve/CVE-2026-34588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34982",
"url": "https://access.redhat.com/security/cve/CVE-2026-34982"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35177",
"url": "https://access.redhat.com/security/cve/CVE-2026-35177"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35385",
"url": "https://access.redhat.com/security/cve/CVE-2026-35385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35386",
"url": "https://access.redhat.com/security/cve/CVE-2026-35386"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35387",
"url": "https://access.redhat.com/security/cve/CVE-2026-35387"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35388",
"url": "https://access.redhat.com/security/cve/CVE-2026-35388"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35414",
"url": "https://access.redhat.com/security/cve/CVE-2026-35414"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3833",
"url": "https://access.redhat.com/security/cve/CVE-2026-3833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39979",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40164",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40356",
"url": "https://access.redhat.com/security/cve/CVE-2026-40356"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41142",
"url": "https://access.redhat.com/security/cve/CVE-2026-41142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41411",
"url": "https://access.redhat.com/security/cve/CVE-2026-41411"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41989",
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42009",
"url": "https://access.redhat.com/security/cve/CVE-2026-42009"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42010",
"url": "https://access.redhat.com/security/cve/CVE-2026-42010"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42011",
"url": "https://access.redhat.com/security/cve/CVE-2026-42011"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42012",
"url": "https://access.redhat.com/security/cve/CVE-2026-42012"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42013",
"url": "https://access.redhat.com/security/cve/CVE-2026-42013"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42014",
"url": "https://access.redhat.com/security/cve/CVE-2026-42014"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42015",
"url": "https://access.redhat.com/security/cve/CVE-2026-42015"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42216",
"url": "https://access.redhat.com/security/cve/CVE-2026-42216"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46483",
"url": "https://access.redhat.com/security/cve/CVE-2026-46483"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47162",
"url": "https://access.redhat.com/security/cve/CVE-2026-47162"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47167",
"url": "https://access.redhat.com/security/cve/CVE-2026-47167"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4775",
"url": "https://access.redhat.com/security/cve/CVE-2026-4775"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4786",
"url": "https://access.redhat.com/security/cve/CVE-2026-4786"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48864",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5260",
"url": "https://access.redhat.com/security/cve/CVE-2026-5260"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-52858",
"url": "https://access.redhat.com/security/cve/CVE-2026-52858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5419",
"url": "https://access.redhat.com/security/cve/CVE-2026-5419"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54369",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54411",
"url": "https://access.redhat.com/security/cve/CVE-2026-54411"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5450",
"url": "https://access.redhat.com/security/cve/CVE-2026-5450"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55693",
"url": "https://access.redhat.com/security/cve/CVE-2026-55693"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55971",
"url": "https://access.redhat.com/security/cve/CVE-2026-55971"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57455",
"url": "https://access.redhat.com/security/cve/CVE-2026-57455"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57456",
"url": "https://access.redhat.com/security/cve/CVE-2026-57456"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58010",
"url": "https://access.redhat.com/security/cve/CVE-2026-58010"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58011",
"url": "https://access.redhat.com/security/cve/CVE-2026-58011"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58012",
"url": "https://access.redhat.com/security/cve/CVE-2026-58012"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58013",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58014",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58015",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58016",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59856",
"url": "https://access.redhat.com/security/cve/CVE-2026-59856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59858",
"url": "https://access.redhat.com/security/cve/CVE-2026-59858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-60002",
"url": "https://access.redhat.com/security/cve/CVE-2026-60002"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6100",
"url": "https://access.redhat.com/security/cve/CVE-2026-6100"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6477",
"url": "https://access.redhat.com/security/cve/CVE-2026-6477"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64830",
"url": "https://access.redhat.com/security/cve/CVE-2026-64830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73066",
"url": "https://access.redhat.com/security/cve/CVE-2026-73066"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73072",
"url": "https://access.redhat.com/security/cve/CVE-2026-73072"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73076",
"url": "https://access.redhat.com/security/cve/CVE-2026-73076"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73077",
"url": "https://access.redhat.com/security/cve/CVE-2026-73077"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73078",
"url": "https://access.redhat.com/security/cve/CVE-2026-73078"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8643",
"url": "https://access.redhat.com/security/cve/CVE-2026-8643"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai",
"url": "https://www.redhat.com/en/products/ai"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74674.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Base Images 3.4.3 (Neuron)",
"tracking": {
"current_release_date": "2026-10-02T17:42:35+00:00",
"generator": {
"date": "2026-10-02T17:42:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:74674",
"initial_release_date": "2026-10-01T20:54:01+00:00",
"revision_history": [
{
"date": "2026-10-01T20:54:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-01T20:54:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-02T17:42:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift AI 3.4",
"product": {
"name": "Red Hat OpenShift AI 3.4",
"product_id": "Red Hat OpenShift AI 3.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_ai:3.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift AI"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64",
"product": {
"name": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64",
"product_id": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/base-image-neuron-rhel9@sha256%3Afc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-neuron-rhel9\u0026tag=1790703542"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64 as a component of Red Hat OpenShift AI 3.4",
"product_id": "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
},
"product_reference": "registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64",
"relates_to_product_reference": "Red Hat OpenShift AI 3.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-52355",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251326"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The identified out-of-memory vulnerability in libtiff, triggered by a crafted TIFF file passed to the TIFFRasterScanlineSize64() API, presents a moderate severity concern rather than a important one due to several factors. Primarily, the exploit requires the crafted input to be smaller than 379 KB, imposing a limitation on the potential impact and reducing the likelihood of successful exploitation in practical scenarios. Furthermore, the nature of the vulnerability is limited to denial-of-service attacks, which, although disruptive, do not inherently pose a direct risk of data compromise or system compromise. However, it\u0027s important to acknowledge that denial-of-service attacks can still have significant operational implications, particularly in environments reliant on continuous availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52355"
},
{
"category": "external",
"summary": "RHBZ#2251326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52355"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/621",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/621"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM"
},
{
"cve": "CVE-2024-34459",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2024-05-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2280532"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects the xmllint program when the `--htmlout\u0027 command line option is used. Additionally, an application is not vulnerable if it does not use or expose the xmllint program.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"category": "external",
"summary": "RHBZ#2280532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280532"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34459",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"
}
],
"release_date": "2024-05-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Do not process untrusted files with the xmllint program.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c"
},
{
"acknowledgments": [
{
"names": [
"Ahmed Lekssays"
]
}
],
"cve": "CVE-2025-6170",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-06-16T05:33:22.955000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has rated the severity of this vulnerability as Low, since it affects only the interactive shell mode of the xmllint tool and requires a user to manually run the tool and enter or receive specially crafted input. The exploitation requires local access and a highly specific usage scenario that is uncommon in typical environments. While it can cause a crash, the impact is limited to availability, and exploitation is unlikely in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "RHBZ#2372952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
}
],
"release_date": "2025-06-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling"
},
{
"cve": "CVE-2025-10911",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2025-09-24T12:46:50.095000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397838"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: use-after-free with key data stored cross-RVT",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "RHBZ#2397838",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
}
],
"release_date": "2025-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: use-after-free with key data stored cross-RVT"
},
{
"acknowledgments": [
{
"names": [
"Sovereign Tech Resilience program"
],
"organization": "Sovereign Tech Agency"
},
{
"names": [
"treeplus"
]
}
],
"cve": "CVE-2025-14087",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-12-05T08:35:24.744000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2419093"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: GLib: Buffer underflow in GVariant parser leads to heap corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The highest threat is to system availability due to potential application crashes when processing maliciously crafted input strings through GLib\u0027s GVariant parser. This issue affects applications that utilize g_variant_parse() on untrusted data, leading to memory corruption and possible denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14087"
},
{
"category": "external",
"summary": "RHBZ#2419093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14087",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834"
}
],
"release_date": "2025-12-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: GLib: Buffer underflow in GVariant parser leads to heap corruption"
},
{
"acknowledgments": [
{
"names": [
"Codean Labs"
]
}
],
"cve": "CVE-2025-14512",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-12-11T06:22:59.701000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2421339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib\u0027s GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products because an integer overflow in GLib\u0027s GIO `escape_byte_string()` function can lead to a heap buffer overflow and denial-of-service. This occurs when processing specially crafted file or remote filesystem attribute values, requiring an attacker to provide malicious input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14512"
},
{
"category": "external",
"summary": "RHBZ#2421339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14512",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845"
}
],
"release_date": "2025-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow"
},
{
"cve": "CVE-2026-3833",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-03-09T14:02:09.783000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is particularly important because it affects the correct enforcement of X.509 nameConstraints, which are specifically designed to limit the authority of subordinate CAs. In GnuTLS, the use of case-sensitive comparisons (memcmp) for dNSName and the domain portion of rfc822Name violates the case-insensitive matching requirements defined in RFC 5280 and RFC 4343. As a result, a constrained subordinate CA can bypass excludedSubtrees or permittedSubtrees restrictions simply by changing the letter casing of a domain in the SAN (e.g., ExAmPlE.CoM vs example.com). Since nameConstraints are often the only mechanism enforcing domain boundaries in delegated PKI hierarchies, this flaw effectively allows a malicious or compromised sub-CA to issue certificates for domains that should be cryptographically prohibited, enabling unauthorized certificate validation and potential TLS impersonation of restricted services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3833"
},
{
"category": "external",
"summary": "RHBZ#2445763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1803",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1803"
}
],
"release_date": "2026-04-30T17:26:28.969000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison"
},
{
"acknowledgments": [
{
"names": [
"Quang Luong",
"PrymEvol"
]
}
],
"cve": "CVE-2026-4775",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-03-24T14:23:23.826000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450768"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in the libtiff library, affecting the processing of specially crafted TIFF files, could lead to a denial of service or potentially arbitrary code execution. This vulnerability, caused by a signed integer overflow during TIFF image processing, results in an out-of-bounds heap write. Red Hat products that process untrusted TIFF files using libtiff may be impacted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4775"
},
{
"category": "external",
"summary": "RHBZ#2450768",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4775",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4775"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775"
}
],
"release_date": "2026-03-24T14:33:35.730000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF files with applications linked against the libtiff library. If processing untrusted TIFF files is unavoidable, consider running the affected applications within a sandboxed environment to limit the potential impact of successful exploitation. This operational control helps contain the effects of an out-of-bounds write, reducing the risk of denial of service or arbitrary code execution.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing"
},
{
"cve": "CVE-2026-4786",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-04-13T22:01:38.006388+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458049"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing \"%action\". This bypasses a previous mitigation for CVE-2026-4519.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4786"
},
{
"category": "external",
"summary": "RHBZ#2458049",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/148169",
"url": "https://github.com/python/cpython/issues/148169"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/148170",
"url": "https://github.com/python/cpython/pull/148170"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
}
],
"release_date": "2026-04-13T21:52:19.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API"
},
{
"acknowledgments": [
{
"names": [
"Ali Raza"
]
}
],
"cve": "CVE-2026-4878",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-03-26T06:56:21.213270+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "RHBZ#2451615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
}
],
"release_date": "2026-04-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-5260",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-05-06T19:50:31.302000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5260"
},
{
"category": "external",
"summary": "RHBZ#2467450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5260"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange"
},
{
"acknowledgments": [
{
"names": [
"Doria Tang"
],
"organization": "Stony Brook University"
}
],
"cve": "CVE-2026-5419",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"discovery_date": "2026-05-07T11:02:44.331000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467686"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Information disclosure via timing side-channel in PKCS#7 padding removal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with a Low severity impact because exploiting timing side-channels in cryptographic operations over a network requires precise measurement capabilities, extensive request volume, and low network jitter. While applications linking against GnuTLS to process encrypted PKCS#7 payloads are exposed to subtle processing time variances, successful extraction of plaintext padding or message content in typical Red Hat environments remains computationally complex and technically difficult to execute reliably.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5419"
},
{
"category": "external",
"summary": "RHBZ#2467686",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5419"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-13",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-13"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "gnutls: gnutls: Information disclosure via timing side-channel in PKCS#7 padding removal"
},
{
"cve": "CVE-2026-5450",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-20T21:01:35.403778+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459853"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc (GNU C Library). This vulnerability occurs when an application uses the `scanf` family of functions with a `%mc` format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination can lead to a one-byte heap buffer overflow, potentially allowing an attacker to corrupt memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Because this flaw requires that an affected application call the affected functions with an attacker-supplied value, Red Hat assesses the Attack Complexity of this flaw as High. Additionally, the flaw overflows a single byte onto the heap, so meaningful exploitation requires that the heap is structured such that a single byte can lead to an attacker-controlled outcome, or that the affected functions can be invoked with an attacker-controlled buffer base address. Regarding Attack Vector and Privileges Required, Red Hat assesses these elements as Local and Low respectively, as remote unauthenticated exploitation would require all the conditions above in a library client that listened on a network port and processed attacker-controllable data with the affected library functions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5450"
},
{
"category": "external",
"summary": "RHBZ#2459853",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459853"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5450"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450"
},
{
"category": "external",
"summary": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u",
"url": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450"
}
],
"release_date": "2026-04-20T20:55:41.170000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width"
},
{
"cve": "CVE-2026-6100",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-04-13T18:01:31.970255+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6100"
},
{
"category": "external",
"summary": "RHBZ#2457932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
"url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
"url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
"url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/148395",
"url": "https://github.com/python/cpython/issues/148395"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/148396",
"url": "https://github.com/python/cpython/pull/148396"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
}
],
"release_date": "2026-04-13T17:15:47.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules"
},
{
"cve": "CVE-2026-6477",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-05-14T14:01:31.087667+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477442"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client\u0027s stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT buffer overflow in PostgreSQL libpq allows a malicious server superuser to overwrite client stack memory via lo_* functions. Exploitation requires the victim to connect to a compromised or malicious server (UI:R). The scope is changed as the server attack affects the client system. Impact is high to confidentiality, integrity, and availability through potential client-side code execution. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6477"
},
{
"category": "external",
"summary": "RHBZ#2477442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477442"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6477"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6477/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6477/"
}
],
"release_date": "2026-05-14T13:00:12.497000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-8643",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-04-22T23:09:35+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460927"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in pip\u0027s wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user\u0027s permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8643"
},
{
"category": "external",
"summary": "RHBZ#2460927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8643"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643"
},
{
"category": "external",
"summary": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb",
"url": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb"
}
],
"release_date": "2026-05-27T17:03:36.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite"
},
{
"acknowledgments": [
{
"names": [
"AISLE Research"
],
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-10118",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-21T23:20:23+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460428"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Poppler\u0027s Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based memory corruption flaw in Poppler\u0027s Splash backend. Processing a specially crafted PDF document can lead to an integer overflow, resulting in an undersized heap allocation and a subsequent out-of-bounds write. This could allow an attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service within the context of the application rendering the PDF. To successfully exploit this vulnerability the attacker needs to be able to supply the maliciously crafted PDF file to the application consuming poppler or trick the user to process the PDF file using the Poppler\u0027s backend.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10118"
},
{
"category": "external",
"summary": "RHBZ#2460428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715",
"url": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715"
}
],
"release_date": "2026-06-01T15:25:35.578000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid opening untrusted or suspicious PDF documents with applications that utilize the Poppler library for rendering. Limiting exposure to untrusted content can reduce the risk of exploitation.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication"
},
{
"cve": "CVE-2026-11822",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-09T20:01:15.006955+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487258"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "RHBZ#2487258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
"url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
}
],
"release_date": "2026-06-09T19:08:31.019000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
},
{
"cve": "CVE-2026-11824",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-09T20:02:19.874232+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "RHBZ#2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
"url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
}
],
"release_date": "2026-06-09T19:21:42.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
},
{
"cve": "CVE-2026-11940",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-23T17:05:33.822236+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491848"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products that appear in dependency searches under names containing \"tarfile\" but that are not the CPython standard-library tarfile module are not affected by this flaw. Matches such as the Go packages under github.com/containers/image / go.podman.io/image (.../docker/tarfile and .../docker/internal/tarfile) and the Apache Camel artifacts (camel-tarfile, camel-quarkus-tarfile) are unrelated implementations in other languages and do not include the vulnerable CPython tarfile.extractall() filter logic. The separately packaged PyPI component backports-tarfile is also out of scope for this CVE as assigned: it is not the CPython stdlib module named in the advisory and this CVE tracks the interpreter-provided tarfile shipped in Red Hat python3* packages.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11940"
},
{
"category": "external",
"summary": "RHBZ#2491848",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491848"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11940"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/151558",
"url": "https://github.com/python/cpython/issues/151558"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/151559",
"url": "https://github.com/python/cpython/pull/151559"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"
}
],
"release_date": "2026-06-23T16:04:17.321000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
},
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
},
{
"cve": "CVE-2026-14164",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2493411"
}
],
"notes": [
{
"category": "description",
"text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "RHBZ#2493411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/issues/3069",
"url": "https://github.com/libarchive/libarchive/issues/3069"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/3071",
"url": "https://github.com/libarchive/libarchive/pull/3071"
}
],
"release_date": "2026-05-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
},
{
"cve": "CVE-2026-15308",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-09T18:02:10.090070+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498608"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Python\u0027s `html.parser.HTMLParser` can lead to a denial of service. By supplying specially crafted, malformed HTML with repeated unterminated markup declarations, an attacker can cause excessive CPU consumption, rendering the system unresponsive. Red Hat products utilizing this parser to process untrusted HTML content are susceptible to resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15308"
},
{
"category": "external",
"summary": "RHBZ#2498608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498608"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15308"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9",
"url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced",
"url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606",
"url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd",
"url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/153030",
"url": "https://github.com/python/cpython/issues/153030"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/153031",
"url": "https://github.com/python/cpython/pull/153031"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
}
],
"release_date": "2026-07-09T17:10:57.317000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
},
{
"acknowledgments": [
{
"names": [
"Gitee Codepecker Lab"
]
}
],
"cve": "CVE-2026-15588",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499675"
}
],
"notes": [
{
"category": "description",
"text": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the `GDBus` component of GLib. A local or remote unauthenticated attacker could send an engineered stream of data without line length limitations during the authentication process (`gdbusauth`), leading to excessive memory allocation and CPU consumption. This resource exhaustion can result in a denial-of-service (DoS) condition, causing applications or services dependent on GLib to become unstable or crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15588"
},
{
"category": "external",
"summary": "RHBZ#2499675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985"
}
],
"release_date": "2026-07-12T10:10:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering"
},
{
"acknowledgments": [
{
"names": [
"asotyc"
]
}
],
"cve": "CVE-2026-16118",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-07-17T13:20:23.862000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2501732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker must convince a user to install a malicious MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) and process it with an application performing MIME type detection, limiting its exposure. Also, only little-endian systems are vulnerable. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "RHBZ#2501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41",
"url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
}
],
"release_date": "2026-07-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Do not install a MIME magic file or content from untrusted sources.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c"
},
{
"cve": "CVE-2026-26740",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-03-18T19:01:41.415027+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in giflib. A remote attacker can exploit a buffer overflow vulnerability in the EGifGCBToExtension function by providing a specially crafted Graphics Control Extension (GCE) block. This allows overwriting an existing GCE block without proper size validation, leading to a denial of service (DoS) on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The openjdk-headless packages do not include java.desktop, which is the only code that uses giflib. Therefore, headless-only environments are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26740"
},
{
"category": "external",
"summary": "RHBZ#2448747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26740"
},
{
"category": "external",
"summary": "https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md",
"url": "https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension"
},
{
"cve": "CVE-2026-29111",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T22:01:54.593547+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "RHBZ#2450505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
"url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
"url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
"url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
}
],
"release_date": "2026-03-23T21:03:56.120000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
},
{
"cve": "CVE-2026-31790",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-03-25T02:59:10.179000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451094"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "RHBZ#2451094",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260407.txt",
"url": "https://openssl-library.org/news/secadv/20260407.txt"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
},
{
"cve": "CVE-2026-33845",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-03-24T05:35:59.740000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue marked as Important severity due to its remote, pre-authentication reachability and its impact on a critical DTLS handshake parsing path. The vulnerability can be triggered by an unauthenticated attacker sending crafted DTLS handshake fragments, requiring no prior access or interaction. It leads to an out-of-bounds read caused by an integer underflow in fragment reassembly, operating entirely on attacker-controlled input. Such flaws in low-level protocol parsing are particularly serious, as they may result in disclosure of sensitive process memory, including cryptographic or session-related data, and can also cause reliable application crashes leading to denial of service. Given that DTLS is commonly used in network-facing services such as VPNs and real-time communication systems, the exposure surface is broad. The combination of unauthenticated remote exploitation, memory safety violation, and potential confidentiality and availability impact justifies classifying this issue as high severity rather than moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33845"
},
{
"category": "external",
"summary": "RHBZ#2450624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33845",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33845"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33845",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33845"
}
],
"release_date": "2026-04-30T17:28:41.473000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment"
},
{
"cve": "CVE-2026-33846",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-03-24T05:38:09.899000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450625"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability should be classified as an important flaw rather than moderate because it exposes a pre-authentication, remotely reachable heap buffer overflow in the DTLS handshake processing path, which is part of the core protocol handling logic and commonly exposed in network-facing services. The flaw enables an attacker to inject controlled data at attacker-chosen offsets and sizes beyond allocated heap boundaries by exploiting inconsistent message_length handling across fragments, effectively creating a constrained but meaningful heap write primitive. Unlike benign memory safety bugs, this condition is deterministically triggerable with a small number of crafted packets and no environmental dependencies for denial-of-service, and it targets a long-lived parsing state where memory corruption can affect adjacent heap structures. Even if reliable code execution requires additional heap manipulation or layout knowledge, the combination of remote reachability, lack of authentication, controlled memory corruption capability, and trivial crashability significantly elevates the risk profile beyond moderate severity. In real-world deployments, such primitives are often sufficient to enable heap grooming and exploitation chains, particularly in services that repeatedly process attacker-controlled input, making this a materially important security flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33846"
},
{
"category": "external",
"summary": "RHBZ#2450625",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33846"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33846",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33846"
}
],
"release_date": "2026-05-04T08:53:59.249000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly"
},
{
"cve": "CVE-2026-34588",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-06T16:02:38.673068+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34588"
},
{
"category": "external",
"summary": "RHBZ#2455408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588"
},
{
"category": "external",
"summary": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf"
}
],
"release_date": "2026-04-06T15:31:57.602000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file"
},
{
"cve": "CVE-2026-34982",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-06T16:02:10.004743+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455400"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: arbitrary command execution via modeline sandbox bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34982"
},
{
"category": "external",
"summary": "RHBZ#2455400",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34982"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/01/1",
"url": "http://www.openwall.com/lists/oss-security/2026/04/01/1"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615",
"url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0276",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0276"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9",
"url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9"
}
],
"release_date": "2026-04-06T15:16:48.809000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file:\n\n~~~\nset nomodeline\n~~~",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: arbitrary command execution via modeline sandbox bypass"
},
{
"cve": "CVE-2026-35177",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-04-06T19:01:00.182513+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455542"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim\u0027s zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or further system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "There\u0027s a flaw in `zip.vim` plugin in Vim, allowing a local attacker to overwrite arbitrary files. A user must be tricked into opening a specially crafted zip archive for exploitation, potentially compromising data integrity or the system. When successfully exploited this vulnerability enables the attacker to overwrite arbitrary files or inject code in sensitive system\u0027s location, the impact of the exploitation depends on the privileges which the `vim` process is being executed. Sensitive or privileges files are only susceptible to be overwritten only if the `vim` process is being executed by a high privileged user.\n\nRed Hat Product Security team has rated this vulnerability as having a impact of MODERATE, this decision was made by the fact the user needs to be tricked to open a maliciously crafted file in order to a successful attack to be performed. Additionally the impact will be limited to files which the user running the `vim` process has write permissions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35177"
},
{
"category": "external",
"summary": "RHBZ#2455542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35177"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35177",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35177"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24",
"url": "https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24"
}
],
"release_date": "2026-04-06T17:54:42.779000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Avoid opening untrusted zip archives with Vim. This operational control prevents the necessary user interaction required to trigger the path traversal vulnerability in the `zip.vim` plugin.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass"
},
{
"cve": "CVE-2026-35385",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-04-02T17:01:07.052864+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454469"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35385"
},
{
"category": "external",
"summary": "RHBZ#2454469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T16:30:59.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode"
},
{
"cve": "CVE-2026-35386",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-02T18:02:24.149353+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454506"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the \u0027%\u0027 character in `ssh_config`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products do not ship in a configuration which is subject to this vulnerability. Additionally, the impact of the command execution is limited to the scope of the specific user account which users would need to create themselves.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35386"
},
{
"category": "external",
"summary": "RHBZ#2454506",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454506"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35386"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35386",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35386"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T16:44:27.806000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username"
},
{
"cve": "CVE-2026-35387",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"discovery_date": "2026-04-02T18:01:38.952994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454494"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. This vulnerability allows the system to use unintended Elliptic Curve Digital Signature Algorithm (ECDSA) algorithms. This occurs because the configuration for accepted public key algorithms is misinterpreted, leading to the use of weaker cryptographic methods than intended. This could potentially allow an attacker to compromise the confidentiality of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The cipher choices which may be used as a result of this flaw may provide fewer bits of security than those configured by the user, however they are all still considered cryptographically secure. Users who work in regulated environments may however find themselves using ciphers which are not approved in their regulatory environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35387"
},
{
"category": "external",
"summary": "RHBZ#2454494",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454494"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35387"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T16:52:53.623000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage"
},
{
"cve": "CVE-2026-35388",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-04-02T18:02:01.536010+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454500"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. This vulnerability allows for a low integrity impact due to the omission of connection multiplexing confirmation for proxy-mode multiplexing sessions. A local user, under specific and complex conditions requiring user interaction, could potentially establish a multiplexed session without explicit confirmation, leading to unintended data handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35388"
},
{
"category": "external",
"summary": "RHBZ#2454500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454500"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35388"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T16:57:31.073000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.2,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions"
},
{
"cve": "CVE-2026-35414",
"cwe": {
"id": "CWE-168",
"name": "Improper Handling of Inconsistent Special Elements"
},
"discovery_date": "2026-04-02T18:01:25.983089+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454490"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. This vulnerability arises from the incorrect handling of the authorized_keys principals option in uncommon scenarios. Specifically, when a principals list is used with a Certificate Authority that includes comma characters, OpenSSH may misinterpret the input. This could lead to security bypasses, potentially allowing unintended access or information disclosure in specific authentication contexts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The risk posed by this flaw to Red Hat products is limited. The use of SSH certificates is not enabled by default and requires that users opt-in to the feature. Further, when following documented guidance ssh connections should only be permitted to non-root users which will limit the impact of this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35414"
},
{
"category": "external",
"summary": "RHBZ#2454490",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454490"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35414"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35414",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35414"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T17:08:15.628000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option"
},
{
"cve": "CVE-2026-39979",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-13T23:01:01.219840+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458077"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "RHBZ#2458077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
}
],
"release_date": "2026-04-13T22:18:56.252000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
},
{
"cve": "CVE-2026-40164",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-14T00:01:04.003115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458084"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "RHBZ#2458084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
"url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
}
],
"release_date": "2026-04-13T23:40:12.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
},
{
"cve": "CVE-2026-40356",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-04-28T07:01:37.543641+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer underflow and an out-of-bounds read vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact denial of service flaw in MIT Kerberos 5 (krb5) allows an unauthenticated remote attacker to trigger an integer underflow and out-of-bounds read. This vulnerability, which can lead to process termination, specifically affects systems where the NegoEx mechanism is registered and `gss_accept_sec_context()` is called. While Kerberos is a fundamental service, the prerequisite of a registered NegoEx mechanism limits the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40356"
},
{
"category": "external",
"summary": "RHBZ#2463368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356"
},
{
"category": "external",
"summary": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html",
"url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
},
{
"category": "external",
"summary": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f",
"url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
},
{
"category": "external",
"summary": "https://web.mit.edu/kerberos/advisories/",
"url": "https://web.mit.edu/kerberos/advisories/"
}
],
"release_date": "2026-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the NegoEx mechanism is not registered in the `/etc/gss/mech` configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read"
},
{
"cve": "CVE-2026-41142",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-07T05:01:36.385532+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467623"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can lead to a heap out-of-bounds write, potentially allowing a remote attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in OpenEXR, which could lead to arbitrary code execution, sensitive information disclosure, or denial of service. The flaw, an integer overflow in the `ImageChannel::resize` function, is triggered when an application processes a specially crafted OpenEXR image file. Successful exploitation requires user interaction, such as opening a malicious file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41142"
},
{
"category": "external",
"summary": "RHBZ#2467623",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467623"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41142"
},
{
"category": "external",
"summary": "https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4",
"url": "https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4"
},
{
"category": "external",
"summary": "https://github.com/AcademySoftwareFoundation/openexr/pull/2367",
"url": "https://github.com/AcademySoftwareFoundation/openexr/pull/2367"
},
{
"category": "external",
"summary": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg"
}
],
"release_date": "2026-05-07T03:58:09.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, users should avoid processing or opening OpenEXR image files from untrusted or unknown sources. Restricting the input of OpenEXR files to only trusted origins can reduce the risk of exploitation.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing"
},
{
"cve": "CVE-2026-41411",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-24T18:01:49.275019+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461614"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Command injection allows arbitrary code execution via malicious tag files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41411"
},
{
"category": "external",
"summary": "RHBZ#2461614",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461614"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb",
"url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0357",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0357"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8",
"url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"
}
],
"release_date": "2026-04-24T16:51:39.657000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Command injection allows arbitrary code execution via malicious tag files"
},
{
"cve": "CVE-2026-41989",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-23T05:00:56.113348+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461063"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"category": "external",
"summary": "RHBZ#2461063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461063"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
},
{
"category": "external",
"summary": "https://dev.gnupg.org/T8211",
"url": "https://dev.gnupg.org/T8211"
},
{
"category": "external",
"summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html",
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/21/1",
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
}
],
"release_date": "2026-04-23T04:30:26.124000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42009",
"cwe": {
"id": "CWE-475",
"name": "Undefined Behavior for Input to API"
},
"discovery_date": "2026-05-06T16:32:32.382000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467279"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The impact for this flaw has been downgraded on Red Hat Enterprise Linux due to the following reason:\n\n- The number of elements passed to the vulnerable function at runtime is known and is at most 6 and the element size is sufficiently small. glibc\u2019s qsort implementation will not exercise the quick sort code path, which would otherwise cause an infloop or out-of-bound write.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42009"
},
{
"category": "external",
"summary": "RHBZ#2467279",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42009"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42009",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42009"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42010",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"discovery_date": "2026-05-06T16:57:37.044000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467289"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest\u2013Shamir\u2013Adleman \u2013 Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Authentication Bypass via NUL Character in Username",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42010"
},
{
"category": "external",
"summary": "RHBZ#2467289",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42010"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username"
},
{
"acknowledgments": [
{
"names": [
"Haruto Kimura"
],
"organization": "Stella"
}
],
"cve": "CVE-2026-42011",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:06:25.319000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Security bypass due to incorrect name constraint handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42011"
},
{
"category": "external",
"summary": "RHBZ#2467437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Security bypass due to incorrect name constraint handling"
},
{
"acknowledgments": [
{
"names": [
"Oleh Konko"
],
"organization": "1Seal"
}
],
"cve": "CVE-2026-42012",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:16:02.753000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467441"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42012"
},
{
"category": "external",
"summary": "RHBZ#2467441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42012"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs"
},
{
"acknowledgments": [
{
"names": [
"Haruto Kimura"
],
"organization": "Stella"
},
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42013",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:47:00.134000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42013"
},
{
"category": "external",
"summary": "RHBZ#2467448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name"
},
{
"acknowledgments": [
{
"names": [
"Luigino Camastra"
]
},
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42014",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-05-06T19:51:54.069000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467451"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Use-after-free in gnutls_pkcs11_token_set_pin",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42014"
},
{
"category": "external",
"summary": "RHBZ#2467451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42014"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1766",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1766"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-9",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-9"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Use-after-free in gnutls_pkcs11_token_set_pin"
},
{
"acknowledgments": [
{
"names": [
"Zou Dikai"
]
}
],
"cve": "CVE-2026-42015",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2026-05-07T10:50:28.379000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42015"
},
{
"category": "external",
"summary": "RHBZ#2467678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42015"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42015",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42015"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling"
},
{
"cve": "CVE-2026-42216",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-05-07T05:02:12.164992+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467633"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenEXR. A remote attacker could exploit a vulnerability in the IDManifest::init() function when processing specially crafted EXR files. The function attempts to reconstruct strings from a prefix-compressed representation. If a previous string exceeds 255 bytes, the subsequent string is expected to have a 2-byte prefix length. However, the code reads these bytes without validating that the current string has at least two bytes, which could lead to information disclosure or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in OpenEXR that could lead to information disclosure or denial of service. The vulnerability occurs when processing specially crafted EXR files, where an attacker could trigger an out-of-bounds read due to improper validation of string lengths during prefix-compressed string reconstruction. This could impact systems that process untrusted EXR image data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42216"
},
{
"category": "external",
"summary": "RHBZ#2467633",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467633"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42216"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42216",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42216"
},
{
"category": "external",
"summary": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4"
}
],
"release_date": "2026-05-07T04:01:59.602000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted or unverified EXR image files. Users should exercise caution when opening EXR files from unknown or suspicious sources, as this vulnerability requires user interaction with a malicious file.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-46483",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-05-15T16:00:58.827425+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477915"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape() without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: command injection when decompressing .tgz archives",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to convince a user to decompress a .tgz archive with a specially crafted filename. Additionally, possible arbitrary command execution is restricted to the context of the user running Vim. These conditions limit the exposure of this vulnerability and the potential of a full system compromise. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46483"
},
{
"category": "external",
"summary": "RHBZ#2477915",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477915"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46483"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46483",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46483"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1",
"url": "https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0479",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0479"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w",
"url": "https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w"
}
],
"release_date": "2026-05-15T14:57:31.872000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use \u0027tar -x -z -f\u0027 directly, instead.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: command injection when decompressing .tgz archives"
},
{
"cve": "CVE-2026-47162",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-06-11T19:00:56.050612+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary Code Execution via crafted directory names",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47162"
},
{
"category": "external",
"summary": "RHBZ#2487964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47162"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
"url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0495",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
"url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
}
],
"release_date": "2026-06-11T18:32:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary Code Execution via crafted directory names"
},
{
"cve": "CVE-2026-47167",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-11T19:02:45.999423+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487996"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user\u0027s system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via crafted step-definition patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Vim\u0027s cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47167"
},
{
"category": "external",
"summary": "RHBZ#2487996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487996"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47167"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
"url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0496",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
"url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
}
],
"release_date": "2026-06-11T18:31:44.286000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via crafted step-definition patterns"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-48864",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-21T23:19:41+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This heap buffer overflow in libsolv\u0027s page decompression logic can lead to out-of-bounds reads and writes when processing specially crafted `.solv` files. Exploitation requires a victim application to ingest malicious repository metadata, limiting the attack vector to scenarios involving user interaction or untrusted content sources. Given the user interaction needed, Red Hat Product Security has rated this vulnerability as having a impact of Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "RHBZ#2460425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
}
],
"release_date": "2026-05-26T16:07:55.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data"
},
{
"cve": "CVE-2026-52858",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-11T19:01:57.042099+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487981"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user\u0027s system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via Python omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user\u0027s system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-52858"
},
{
"category": "external",
"summary": "RHBZ#2487981",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487981"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-52858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
"url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0561",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
"url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
}
],
"release_date": "2026-06-11T18:32:32.722000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via Python omni-completion"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54369",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: Symlink traversal privilege escalation via libacl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "RHBZ#2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "acl: Symlink traversal privilege escalation via libacl functions"
},
{
"cve": "CVE-2026-54411",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"discovery_date": "2026-06-14T18:00:55.002567+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Linux-PAM\u0027s `pam_userdb` module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the `pam_userdb` module is configured to store and compare credentials in plaintext, which is not a default setting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Linux-PAM\u0027s `pam_userdb` module allows a local or network-adjacent attacker to recover plaintext passwords through a timing discrepancy. This vulnerability requires the `pam_userdb` module to be explicitly configured to store and compare credentials in plaintext, which is not a default or recommended configuration in Red Hat Enterprise Linux environments. The impact is limited by the need for repeated authentication attempts and specific, non-default module configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54411"
},
{
"category": "external",
"summary": "RHBZ#2488766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54411"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/208.html",
"url": "https://cwe.mitre.org/data/definitions/208.html"
},
{
"category": "external",
"summary": "https://github.com/linux-pam/linux-pam",
"url": "https://github.com/linux-pam/linux-pam"
},
{
"category": "external",
"summary": "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h",
"url": "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h"
},
{
"category": "external",
"summary": "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327",
"url": "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"
}
],
"release_date": "2026-06-14T17:21:43.853000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, administrators should ensure that the `pam_userdb` module is not configured to store or compare credentials in plaintext. Verify that `pam_userdb` is either configured with a strong cryptographic hashing method or, if not required, is disabled. Avoid using `crypt=none` or omitting the `crypt=` argument when configuring `pam_userdb`. If changes are made to PAM configuration files, services relying on PAM may need to be restarted for the changes to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module"
},
{
"cve": "CVE-2026-55693",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-06-25T16:02:21.870241+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492980"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55693"
},
{
"category": "external",
"summary": "RHBZ#2492980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
"url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
"url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
}
],
"release_date": "2026-06-25T15:34:33.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
},
{
"cve": "CVE-2026-55971",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-07-27T12:01:58.342437+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects the C++ implementation of Apache Thrift, specifically the ZLIB-enabled THeaderTransport (THeaderTransport::untransform()), which is reachable when a Thrift client or server negotiates the Header transport protocol with ZLIB compression enabled over a network connection. Red Hat ships the affected C++ package (thrift) in RHEL AI and in the Fedora/EPEL community distributions, and it is also consumed by AIPCC\u0027s PyArrow build pipeline (tracked separately as AIPCC-28667); upgrade to Apache Thrift 0.24.0 or later to remediate.\n\nConfirmed usage in RHEL AI 3.4\u0027s GPU bootc images and in the AIPCC PyArrow build pipeline is limited to PyArrow\u0027s Parquet metadata support, which serializes structs via Thrift\u0027s TCompactProtocol directly to an in-memory buffer and does not invoke THeaderTransport. As a result, this usage does not expose the vulnerable code path to network input; it would require local access to a maliciously crafted Parquet file instead.\n\nOther Red Hat components that reference Apache Thrift via the Go implementation (github.com/apache/thrift) or the Java Maven artifact (org.apache.thrift:libthrift) depend on independently implemented, separately maintained codebases; the Java bindings do not include the vulnerable ZLIB THeaderTransport code path (and CWE-122 heap corruption does not apply to JVM memory-managed arrays) and are therefore not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55971"
},
{
"category": "external",
"summary": "RHBZ#2507448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55971"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx",
"url": "https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx"
}
],
"release_date": "2026-07-27T11:11:23.201000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "No mitigation is available other than upgrading to Apache Thrift 0.24.0 or later, which contains the fix. AIPCC\u0027s PyArrow build pipeline is tracked separately for remediation under AIPCC-28667.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow"
},
{
"cve": "CVE-2026-57455",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-25T16:01:18.343208+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492968"
}
],
"notes": [
{
"category": "description",
"text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57455"
},
{
"category": "external",
"summary": "RHBZ#2492968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
"url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
"url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
}
],
"release_date": "2026-06-25T15:22:37.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
},
{
"cve": "CVE-2026-57456",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-25T16:01:37.648886+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492972"
}
],
"notes": [
{
"category": "description",
"text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57456"
},
{
"category": "external",
"summary": "RHBZ#2492972",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
"url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
"url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
}
],
"release_date": "2026-06-25T15:16:16.015000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58010",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:21:49.589000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses \u003e instead of \u003e=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications calling the `g_variant_is_normal_form()`,\u00a0`g_variant_get_normal_form()` or\u00a0`g_variant_byteswap()` functions that process untrusted GVariant data received from D-Bus, network or file are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 1 byte, leading to an information disclosure of only 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58010"
},
{
"category": "external",
"summary": "RHBZ#2492243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915"
}
],
"release_date": "2026-03-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58011",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-24T16:30:03.305000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications that allow a user to submit a date to `g_date_time_add_full()` and later call any getter functions, such as `g_date_time_get_month()` or `g_date_time_get_year()`, with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors that a corrupted date can trigger. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58011"
},
{
"category": "external",
"summary": "RHBZ#2492245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917"
}
],
"release_date": "2026-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58012",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:40:58.048000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492247"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications that use g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag and allow user-controlled replacement strings containing case-change escapes (\\u,\u00a0\\l,\u00a0\\U,\u00a0\\L) are vulnerable to this issue. This flaw can cause a buffer over-read of 1-5 bytes, leading to a minor information disclosure and a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58012"
},
{
"category": "external",
"summary": "RHBZ#2492247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58012"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918"
}
],
"release_date": "2026-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\\u, \\l, \\U, \\L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58013",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:49:18.947000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492248"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue. This flaw can cause a buffer over-read of 8 bytes, leading to an information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"category": "external",
"summary": "RHBZ#2492248",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925"
}
],
"release_date": "2026-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\""
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58014",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2026-06-24T17:16:25.796000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "RHBZ#2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
},
{
"acknowledgments": [
{
"names": [
"Thepwnisher"
]
}
],
"cve": "CVE-2026-58015",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-24T17:22:00.405000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "RHBZ#2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58016",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-24T17:29:08.344000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications processing D-Bus introspection XML input from untrusted sources with g_dbus_node_info_new_for_xml() are vulnerable to this issue. In GLib itself, the gdbus command line tool is the primary vector for local exploitation. However, other applications using the vulnerable function may process untrusted input in a way that allows a remote attacker to trigger this flaw. This vulnerability can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "RHBZ#2492257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58016"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted D-Bus introspection XML, specifically rejecting malformed structures such as \u003cnode\u003e elements improperly nested within \u003cmethod\u003e, \u003csignal\u003e, \u003cproperty\u003e or \u003carg\u003e elements before calling g_dbus_node_info_new_for_xml(). Alternatively, restricting the application to only process XML input from trusted, authenticated sources will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\""
},
{
"cve": "CVE-2026-59856",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-07-09T23:01:40.406872+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59856"
},
{
"category": "external",
"summary": "RHBZ#2498867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
"url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
"url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
}
],
"release_date": "2026-07-09T22:39:01.803000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
},
{
"cve": "CVE-2026-59858",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-07-09T23:01:43.278752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498868"
}
],
"notes": [
{
"category": "description",
"text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59858"
},
{
"category": "external",
"summary": "RHBZ#2498868",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
"url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
"url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
}
],
"release_date": "2026-07-09T22:37:52.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
},
{
"cve": "CVE-2026-60002",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-08T01:01:33.808610+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497936"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-60002"
},
{
"category": "external",
"summary": "RHBZ#2497936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-60002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:17:33.058000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side"
},
{
"cve": "CVE-2026-64830",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-22T18:01:30.962327+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506193"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg\u0027s VobSub demuxer. This could allow an attacker to take control of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap buffer overflow in FFmpeg\u0027s VobSub subtitle demuxer can lead to arbitrary code execution when processing a specially crafted subtitle file. Exploitation requires user interaction, such as opening a malicious media file, which reduces the attack surface but can result in high impact if an affected application processes untrusted content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64830"
},
{
"category": "external",
"summary": "RHBZ#2506193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506193"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer",
"url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"
}
],
"release_date": "2026-07-22T16:33:05.724000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing VobSub subtitle files from untrusted or unknown sources. For applications that utilize FFmpeg\u0027s VobSub demuxer, consider running them within a sandboxed environment to restrict the potential impact of a successful exploit.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer."
},
{
"cve": "CVE-2026-73066",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-11T15:01:14.226581+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract\u0027s deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73066"
},
{
"category": "external",
"summary": "RHBZ#2514011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73066"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72",
"url": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/pull/4588",
"url": "https://github.com/tesseract-ocr/tesseract/pull/4588"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3",
"url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8"
}
],
"release_date": "2026-08-11T14:49:16.817000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing `.traineddata` files from untrusted sources with Tesseract. Ensure that only `.traineddata` files from known, reputable origins are used for OCR recognition.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata"
},
{
"cve": "CVE-2026-73072",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-11T15:41:15.596551+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514037"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Heap buffer overflow allows arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A local attacker can exploit an Important heap buffer overflow in Vim to execute arbitrary code by tricking a user into loading a malicious spell file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73072"
},
{
"category": "external",
"summary": "RHBZ#2514037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514037"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
"url": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0846",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0846"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64",
"url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
}
],
"release_date": "2026-08-11T15:31:35.331000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim\u2019s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Heap buffer overflow allows arbitrary code execution"
},
{
"cve": "CVE-2026-73076",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-11T15:41:02.894650+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514034"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary command execution via crafted vimball",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Vim where a crafted vimball can lead to arbitrary command execution. The flaw allows an attacker to embed malicious commands within a `.VimballRecord` file, which are then executed with user privileges during a later, unrelated vimball installation or removal. This extends the impact of processing untrusted vimball files beyond the initial installation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73076"
},
{
"category": "external",
"summary": "RHBZ#2514034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514034"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452",
"url": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2",
"url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
}
],
"release_date": "2026-08-11T15:37:59.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary command execution via crafted vimball"
},
{
"cve": "CVE-2026-73077",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-11T16:11:25.535913+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514065"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in Vim\u0027s shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Vim\u0027s shell plugins allows full system compromise in Red Hat environments if a user selects crafted text in Visual mode and triggers a keyword lookup. This does not affect RHEL 8 and older versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73077"
},
{
"category": "external",
"summary": "RHBZ#2514065",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514065"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73077"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
"url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
"url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
}
],
"release_date": "2026-08-11T15:39:24.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory:\n\n- `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=`\n\nThis change takes effect the next time a shell script is opened in Vim.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling"
},
{
"cve": "CVE-2026-73078",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-08-11T16:10:59.827742+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514058"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in Vim\u0027s netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Vim\u0027s `netrw` plugin allows for arbitrary command execution in GUI Vim. By crafting a malicious directory path, an attacker could exploit improper neutralization of special characters when the path is browsed or bookmarked, leading to command injection. This issue specifically impacts GUI installations and requires user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73078"
},
{
"category": "external",
"summary": "RHBZ#2514058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514058"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73078"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
"url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
"url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
}
],
"release_date": "2026-08-11T15:41:08.048000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T20:54:01+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74674",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74674"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.",
"product_ids": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-neuron-rhel9@sha256:fc44ace0f21e043cd2335b21ecfb934cceb4ee82f7fd6c5e07211a6bba71158c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…