RHSA-2025:19428HighCVSS 7.5

Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)

Published
November 3, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2025-8194 →CVE-2025-47273 →CVE-2025-48956 →CVE-2025-57809 →

📋 Description

CVE-2025-8194 — cpython: Cpython infinite loop when parsing a tarfile CVE-2025-47273 — setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-48956 — vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests CVE-2025-57809 — xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars

🎯 Affected products3

  • Red Hat Enterprise Linux AI 1.5
  • registry.redhat.io/rhelai1/bootc-nvidia-rhel9@sha256:0efbdee5f2ec93477b5aac5dd4c1dd9b31fe96e5e7c7dd701738ceaa86b2f2eb_arm64 as a component of Red Hat Enterprise Linux AI 1.5
  • registry.redhat.io/rhelai1/bootc-nvidia-rhel9@sha256:dd412fc0dde3dee492839c28f8ed003bb17fe5fe1be375031b24c84bb36fb8cd_amd64 as a component of Red Hat Enterprise Linux AI 1.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2025:19428 Workaround: This flaw can be mitigated by adding the following code after importing the tarfile module ("import tarfile"): ~~~ import tarfile def _block_patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return _block_patched._orig_block(self, count) _block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Until a fix is available, the risk can be reduced by running vLLM behind a reverse proxy such as Nginx, Envoy, or HAProxy with strict header size limits, ensuring that oversized requests are dropped before reaching the service. Additional safeguards like container or VM resource limits and traffic monitoring can help contain the impact, but upgrading to the patched release remains the definitive solution. Workaround: Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.

🔗 References (8)