RHSA-2026:10141HighCVSS 8.8

Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.1

Published
April 23, 2026
Last Modified
September 12, 2026

🔗 CVE IDs covered (6)

CVE-2026-27893 →CVE-2026-32597 →CVE-2026-4519 →CVE-2026-4786 →CVE-2026-6100 →CVE-2026-25679 →

📋 Description

CVE-2026-4519 — python: Python: Command-line option injection in webbrowser.open() via crafted URLs CVE-2026-4786 — python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API CVE-2026-6100 — python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27893 — vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting CVE-2026-32597 — pyjwt: PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation)

🎯 Affected products2

  • Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/disk-image-cuda-rhel9@sha256:c60621bae671ef55db3e1f474d78d9ba22109518604dc694d7ef49ef2d240059_amd64 as a component of Red Hat Enterprise Linux AI 3.3

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (10)