RHSA-2026:16174HighCVSS 8.2

Red Hat Security Advisory: Red Hat AI Inference Server 3.3.3 (Spyre)

Published
May 12, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (29)

CVE-2025-14831 →CVE-2026-1299 →CVE-2026-25646 →CVE-2026-25749 →CVE-2026-25990 →CVE-2026-23868 →CVE-2026-26209 →CVE-2026-28417 →CVE-2026-33412 →CVE-2026-27135 →CVE-2026-3497 →CVE-2026-4424 →CVE-2026-5121 →CVE-2026-25506 →CVE-2025-15367 →CVE-2026-0994 →CVE-2026-4111 →CVE-2026-4519 →CVE-2026-27622 →CVE-2026-28421 →CVE-2025-15366 →CVE-2025-13836 →CVE-2026-22695 →CVE-2026-40192 →CVE-2023-52356 →CVE-2026-2447 →CVE-2026-5201 →CVE-2026-22801 →CVE-2023-40403 →

📋 Description

CVE-2023-40403 — libxslt: Processing web content may disclose sensitive information CVE-2023-52356 — libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service CVE-2025-13836 — cpython: Excessive read buffering DoS in http.client CVE-2025-14831 — gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification CVE-2025-15366 — cpython: IMAP command injection in user-controlled commands CVE-2025-15367 — cpython: POP3 command injection in user-controlled commands CVE-2026-0994 — python: protobuf: Protobuf: Denial of Service due to recursion depth bypass CVE-2026-1299 — cpython: email header injection due to unquoted newlines CVE-2026-2447 — libvpx: Heap buffer overflow in libvpx CVE-2026-3497 — openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables CVE-2026-4111 — libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive CVE-2026-4424 — libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing CVE-2026-4519 — python: Python: Command-line option injection in webbrowser.open() via crafted URLs CVE-2026-5121 — libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing CVE-2026-5201 — gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image CVE-2026-22695 — libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read CVE-2026-22801 — libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API CVE-2026-23868 — giflib: Giflib: Double-free vulnerability leading to memory corruption CVE-2026-25506 — MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery CVE-2026-25646 — libpng: LIBPNG has a heap buffer overflow in png_set_quantize CVE-2026-25749 — vim: Vim: Arbitrary code execution via 'helpfile' option processing CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-26209 — cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads CVE-2026-27135 — nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-27622 — openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing CVE-2026-28417 — vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin CVE-2026-28421 — vim: Vim: Denial of service and information disclosure via crafted swap file CVE-2026-33412 — vim: Vim: Arbitrary code execution via command injection in glob() function CVE-2026-40192 — Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

🎯 Affected products4

  • Red Hat AI Inference Server 3.3
  • registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:b74a5cc403d0a07b0ef29808cef709121169582b69f2b9ff54a02d35b0cc0908_amd64 as a component of Red Hat AI Inference Server 3.3
  • registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:c79e06a3f71b81ddea9e9e4f51f378f4a5985b9f176e3d17953ffa7cd2b69823_ppc64le as a component of Red Hat AI Inference Server 3.3
  • registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:e272da91193f53a2a498734a0f83934e6e3cae260a9b78f18ba7954a3e4a1b50_s390x as a component of Red Hat AI Inference Server 3.3

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:16174 Workaround: Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads. Applications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit: ~~~ ... max_safe_read = 10 * 1024 * 1024 data = response.read(max_safe_read) ... ~~~ Workaround: To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters. Workaround: To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability's attack surface. Edit `/etc/ssh/sshd_config` and add or modify the line: ``` GSSAPIKeyExchange no ``` After saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI. ``` # systemctl restart sshd ``` Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources. Workaround: To reduce the risk of exploitation, avoid opening or processing untrusted JPEG image files. This operational control helps prevent the automatic triggering of the vulnerability, for example, during thumbnail generation, which could otherwise lead to application instability. Workaround: To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.

🔗 References (33)