RHSA-2025:23080HighCVSS 8.8

Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)

Published
December 10, 2025
Last Modified
August 26, 2026

🔗 CVE IDs covered (20)

CVE-2024-56433 →CVE-2025-9230 →CVE-2025-52565 →CVE-2025-53905 →CVE-2025-62727 →CVE-2025-5318 →CVE-2025-6242 →CVE-2025-6965 →CVE-2025-8176 →CVE-2025-59375 →CVE-2025-59425 →CVE-2023-48022 →CVE-2023-52355 →CVE-2025-9900 →CVE-2025-22868 →CVE-2025-22869 →CVE-2025-53906 →CVE-2025-62593 →CVE-2025-66448 →CVE-2023-52356 →

📋 Description

CVE-2023-48022 — ray: Ray Job Submission Arbitrary Code Execution CVE-2023-52355 — libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM CVE-2023-52356 — libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service CVE-2024-56433 — shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2025-5318 — libssh: out-of-bounds read in sftp_handle() CVE-2025-6242 — vllm: Server Side request forgery (SSRF) in MediaConnector CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-8176 — libtiff: LibTIFF Use-After-Free Vulnerability CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9900 — libtiff: Libtiff Write-What-Where CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-52565 — runc: container escape with malicious config due to /dev/console mount and related races CVE-2025-53905 — vim: Vim path traversial CVE-2025-53906 — vim: Vim path traversal CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59425 — vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass CVE-2025-62593 — ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62727 — starlette: Starlette DoS via Range header merging CVE-2025-66448 — vllm: vLLM: Remote Code Execution via malicious model configuration

🎯 Affected products3

  • Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:14e32e88f1b89f59ed34a6d712746b82a6a54c6ed4727784f18aeff853abbdc7_arm64 as a component of Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:dce6b0ea03379bf06664a5200af8b5f5ae3fad13cdce6d21873843f22554800b_amd64 as a component of Red Hat AI Inference Server 3.2

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2025:23080 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Potential mitigations for this issue include: * Using user namespaces, with the host root user not mapped into the container's namespace. procfs file permissions are managed using Unix DAC and thus user namespaces stop a container process from being able to write to them. * Not running as a root user in the container (this includes disabling setuid binaries with noNewPrivileges). As above, procfs file permissions are managed using Unix DAC and thus non-root users cannot write to them. * The default SELinux policy should mitigate this issue, as the /dev/console bind-mount does not re-label the mount and so the container process should not be able to write to unsafe procfs files. However, CVE-2025-52881 allows an attacker to bypass LSM labels, and so this mitigation is not helpful when considered in combination with CVE-2025-52881. * The default AppArmor profile used by most runtimes will NOT help mitigate this issue, as /dev/console access is permitted. You could create a custom profile that blocks access to /dev/console, but such a profile might break regular containers. In addition, CVE-2025-52881 allows an attacker to bypass LSM labels, and so that mitigation is not helpful when considered in combination with CVE-2025-52881. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (24)