RHSA-2026:19724HighCVSS 8.8

Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)

Published
May 20, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (9)

CVE-2026-4424 →CVE-2026-4519 →CVE-2026-5201 →CVE-2026-23868 →CVE-2026-26209 →CVE-2026-27135 →CVE-2026-3497 →CVE-2026-5121 →CVE-2026-27893 →

📋 Description

CVE-2026-3497 — openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables CVE-2026-4424 — libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing CVE-2026-4519 — python: Python: Command-line option injection in webbrowser.open() via crafted URLs CVE-2026-5121 — libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing CVE-2026-5201 — gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image CVE-2026-23868 — giflib: Giflib: Double-free vulnerability leading to memory corruption CVE-2026-26209 — cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads CVE-2026-27135 — nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-27893 — vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting

🎯 Affected products3

  • Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d76c72da13ef9a39b9cb35a0e0dab744747f3033c161913815ae21fda5fcf75d_arm64 as a component of Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:f7a9ac7e6198c57e9008b257e031f1c47b0b92263590a51be1ee4e328931bb3d_amd64 as a component of Red Hat AI Inference Server 3.2

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:19724 Workaround: To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability's attack surface. Edit `/etc/ssh/sshd_config` and add or modify the line: ``` GSSAPIKeyExchange no ``` After saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI. ``` # systemctl restart sshd ``` Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources. Workaround: To reduce the risk of exploitation, avoid opening or processing untrusted JPEG image files. This operational control helps prevent the automatic triggering of the vulnerability, for example, during thumbnail generation, which could otherwise lead to application instability.

🔗 References (13)