RHSA-2026:3462CriticalCVSS 9.8

Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)

Published
February 27, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (40)

CVE-2023-48022 →CVE-2025-61620 · pendingCVE-2026-22807 →CVE-2024-56433 →CVE-2025-5318 →CVE-2025-53905 →CVE-2025-62164 →CVE-2026-22773 →CVE-2026-24486 →CVE-2025-8176 →CVE-2025-9230 →CVE-2025-15467 →CVE-2025-59375 →CVE-2025-59425 →CVE-2025-66471 →CVE-2025-62727 →CVE-2023-52356 →CVE-2025-22868 →CVE-2025-22869 →CVE-2025-53906 →CVE-2025-62426 →CVE-2025-69223 →CVE-2026-22778 →CVE-2025-6965 →CVE-2025-66418 →CVE-2026-0994 →CVE-2026-24779 →CVE-2025-62372 →CVE-2026-24049 →CVE-2025-62593 →CVE-2025-66448 →CVE-2025-9900 →CVE-2025-47906 →CVE-2025-52565 →CVE-2025-66506 →CVE-2026-25990 →CVE-2023-52355 →CVE-2025-6242 →CVE-2025-9714 →CVE-2026-21441 →

📋 Description

CVE-2023-48022 — ray: Ray Job Submission Arbitrary Code Execution CVE-2023-52355 — libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM CVE-2023-52356 — libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service CVE-2024-56433 — shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2025-5318 — libssh: out-of-bounds read in sftp_handle() CVE-2025-6242 — vllm: Server Side request forgery (SSRF) in MediaConnector CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-8176 — libtiff: LibTIFF Use-After-Free Vulnerability CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9714 — libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c CVE-2025-9900 — libtiff: Libtiff Write-What-Where CVE-2025-15467 — openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-47906 — os/exec: Unexpected paths returned from LookPath in os/exec CVE-2025-52565 — runc: container escape with malicious config due to /dev/console mount and related races CVE-2025-53905 — vim: Vim path traversial CVE-2025-53906 — vim: Vim path traversal CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59425 — vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass CVE-2025-61620 — vllm: vLLM OpenAI-Compatible Server Resource Exhaustion via chat_template Parameters CVE-2025-62164 — vllm: VLLM deserialization vulnerability leading to DoS and potential RCE CVE-2025-62372 — vllm: vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs CVE-2025-62426 — vllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted chat_template_kwargs CVE-2025-62593 — ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62727 — starlette: Starlette DoS via Range header merging CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66448 — vllm: vLLM: Remote Code Execution via malicious model configuration CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2026-0994 — python: protobuf: Protobuf: Denial of Service due to recursion depth bypass CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-22773 — vllm: vLLM: Denial of Service via specially crafted image in multimodal model serving CVE-2026-22778 — vLLM: vLLM: Remote code execution via invalid image processing in the multimodal endpoint. CVE-2026-22807 — vLLM: vLLM: Arbitrary code execution via untrusted model loading CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24486 — python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability CVE-2026-24779 — vLLM: vLLM: Server-Side Request Forgery allows internal network access CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image

🎯 Affected products2

  • Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:53007894763e03f609c35c727cb738db3c2130b19fa0e1069c24240e0870fb7a_amd64 as a component of Red Hat AI Inference Server 3.2

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:3462 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: The impact of this flaw may be reduced by setting strict resource limits to the stack size of processes at the operational system level. This can be achieved either through the 'ulimit' shell built-in or the 'limits.conf' file. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Potential mitigations for this issue include: * Using user namespaces, with the host root user not mapped into the container's namespace. procfs file permissions are managed using Unix DAC and thus user namespaces stop a container process from being able to write to them. * Not running as a root user in the container (this includes disabling setuid binaries with noNewPrivileges). As above, procfs file permissions are managed using Unix DAC and thus non-root users cannot write to them. * The default SELinux policy should mitigate this issue, as the /dev/console bind-mount does not re-label the mount and so the container process should not be able to write to unsafe procfs files. However, CVE-2025-52881 allows an attacker to bypass LSM labels, and so this mitigation is not helpful when considered in combination with CVE-2025-52881. * The default AppArmor profile used by most runtimes will NOT help mitigate this issue, as /dev/console access is permitted. You could create a custom profile that blocks access to /dev/console, but such a profile might break regular containers. In addition, CVE-2025-52881 allows an attacker to bypass LSM labels, and so that mitigation is not helpful when considered in combination with CVE-2025-52881. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: To mitigate this issue, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modification or introduction of malicious code. Implement strict access controls and integrity checks for all model sources. Workaround: To mitigate this vulnerability, avoid enabling the `UPLOAD_KEEP_FILENAME=True` configuration option in applications using `python-multipart`. This option, when used with `UPLOAD_DIR`, allows an attacker to write files to arbitrary locations. Disabling or not configuring `UPLOAD_KEEP_FILENAME=True` prevents the path traversal vulnerability. Workaround: To mitigate this issue, restrict network access to the vLLM service to only trusted clients. Implement strict network segmentation for vLLM pods in containerized environments to limit potential lateral movement. Ensure that vLLM instances are not exposed to untrusted external networks without proper access controls and input validation at the perimeter.

🔗 References (44)