RHSA-2025:19427HighCVSS 7.5

Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (AMD)

Published
November 3, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2025-8194 →CVE-2025-47273 →CVE-2025-48956 →CVE-2025-57809 →

📋 Description

CVE-2025-8194 — cpython: Cpython infinite loop when parsing a tarfile CVE-2025-47273 — setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-48956 — vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests CVE-2025-57809 — xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars

🎯 Affected products2

  • Red Hat Enterprise Linux AI 1.5
  • registry.redhat.io/rhelai1/bootc-amd-rhel9@sha256:c029b66a3354ee6fd186a1f05aff31b5834e611b9d5b326b65b16829d6b98d1f_amd64 as a component of Red Hat Enterprise Linux AI 1.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2025:19427 Workaround: This flaw can be mitigated by adding the following code after importing the tarfile module ("import tarfile"): ~~~ import tarfile def _block_patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return _block_patched._orig_block(self, count) _block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Until a fix is available, the risk can be reduced by running vLLM behind a reverse proxy such as Nginx, Envoy, or HAProxy with strict header size limits, ensuring that oversized requests are dropped before reaching the service. Additional safeguards like container or VM resource limits and traffic monitoring can help contain the impact, but upgrading to the patched release remains the definitive solution. Workaround: Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.

🔗 References (8)