RHSA-2025:19423HighCVSS 7.5

Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)

Published
November 3, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2025-8194 →CVE-2025-47273 →CVE-2025-48956 →CVE-2025-57809 →

📋 Description

CVE-2025-8194 — cpython: Cpython infinite loop when parsing a tarfile CVE-2025-47273 — setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-48956 — vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests CVE-2025-57809 — xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars

🎯 Affected products3

  • Red Hat Enterprise Linux AI 1.5
  • registry.redhat.io/rhelai1/instructlab-nvidia-rhel9@sha256:a17f53b6c19150fce3e6d456fde71a74bdab5da5eeb44bec7791084c3471a98e_arm64 as a component of Red Hat Enterprise Linux AI 1.5
  • registry.redhat.io/rhelai1/instructlab-nvidia-rhel9@sha256:a7e2df4276aaba0d23430c7c3314e05b005fe5628d588bc1f4f979a35571fa5c_amd64 as a component of Red Hat Enterprise Linux AI 1.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2025:19423 Workaround: This flaw can be mitigated by adding the following code after importing the tarfile module ("import tarfile"): ~~~ import tarfile def _block_patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return _block_patched._orig_block(self, count) _block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Until a fix is available, the risk can be reduced by running vLLM behind a reverse proxy such as Nginx, Envoy, or HAProxy with strict header size limits, ensuring that oversized requests are dropped before reaching the service. Additional safeguards like container or VM resource limits and traffic monitoring can help contain the impact, but upgrading to the patched release remains the definitive solution. Workaround: Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.

🔗 References (8)