RHSA-2026:3782CriticalCVSS 9.8

Red Hat Security Advisory: RHOAI 2.25.3 - Red Hat OpenShift AI

Published
March 4, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (33)

CVE-2026-24486 →CVE-2025-14921 →CVE-2025-14927 →CVE-2025-61729 →CVE-2025-14928 →CVE-2026-23745 →CVE-2025-13465 →CVE-2025-14924 →CVE-2026-22807 →CVE-2026-22778 →CVE-2025-59425 →CVE-2025-66448 →CVE-2025-66471 →CVE-2025-68121 →CVE-2025-69228 →CVE-2026-24779 →CVE-2025-14926 →CVE-2025-59057 →CVE-2026-1260 →CVE-2026-24049 →CVE-2025-14925 →CVE-2025-14930 →CVE-2025-61726 →CVE-2025-66418 →CVE-2025-61728 →CVE-2025-69223 →CVE-2026-0897 →CVE-2026-22029 →CVE-2025-14920 →CVE-2025-14929 →CVE-2025-69227 →CVE-2026-21441 →CVE-2026-21884 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-14920 — transformers: code execution when processing a malicious Perceiver model file CVE-2025-14921 — transformers: code execution when processing a malicious Transformer-XL model file CVE-2025-14924 — transformers: code execution when processing a malicious megatron_gpt2 model file CVE-2025-14925 — accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data CVE-2025-14926 — transformers: code execution when converting a malicious SEW model checkpoint CVE-2025-14927 — transformers: code execution when converting a malicious SEW-D model checkpoint CVE-2025-14928 — transformers: code execution when converting a malicious HuBERT model checkpoint CVE-2025-14929 — transformers: code execution when processing a malicious X-CLIP model file CVE-2025-14930 — transformers: code execution when processing a malicious GLM4 model file CVE-2025-59057 — react-router: @remix-run/router: React Router XSS Vulnerability CVE-2025-59425 — vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66448 — vllm: vLLM: Remote Code Execution via malicious model configuration CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-69227 — aiohttp: aiohttp: Denial of Service via specially crafted POST request CVE-2025-69228 — aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request CVE-2026-0897 — Keras: Keras: Denial of Service via crafted HDF5 weight loading file CVE-2026-1260 — sentencepiece: Sentencepiece: Invalid memory access leading to potential arbitrary code execution via a crafted model file. CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-21884 — react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-22778 — vLLM: vLLM: Remote code execution via invalid image processing in the multimodal endpoint. CVE-2026-22807 — vLLM: vLLM: Arbitrary code execution via untrusted model loading CVE-2026-23745 — node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24486 — python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability CVE-2026-24779 — vLLM: vLLM: Server-Side Request Forgery allows internal network access

🎯 Affected products200

  • Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:159f24332f096ac93f33de26c22adee1aed44c529fcdb760510145fe0c990123_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:73ed7aabaf46253b089e037ef04c0e9bc84bc0c2dae43c05bd09b3e9da0e7b37_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:9157f0a0bf30391f0f13c9ddab94890b8c93f0cdd3d38e7844102920ab71a695_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:a62dc3a2b51beea284cd26bb34225891f72092e11591ba6afb9ecd01d4d7c586_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-nlp-rhel9@sha256:1baa7b9cdd2f02ddcdadf74924dd050977c7d792f9dd5c54b13193946ca23328_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-nlp-rhel9@sha256:8a88fd2e77b6321c3ab7a7c4dbd02fb7d7edaa5ec320f04613bb79054b1fc82d_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9@sha256:75bbf9ecb71475e1c84dca0be31d833107fe3341d3323314959d68331ddae82e_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9@sha256:f90e965a1638402b4dec6bb022cbb1d1e992c8fd71d0b687f8562a9abf478dc4_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:5d60cf8e4cfa5a5734e74ddc74fd58190815584c90e8a30cf1ef26b96e008e49_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:ffafea8a0657082676f4fdd8ffcfef90239a8bc4ebcd88dbf71c37e8e1a2dae0_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:4e2c38590e4d912df8cd3a0d459f05908b5ed568e11d31177d8c9b7326404f3e_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:bec247a3dfef0c61a52f382e2d624db4ba5405c71cb6225e11662fb76248d6a4_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:cd00ce43d426c5be89bc79e1e596655a46f5f89b0576a3294859bbde39867419_s390x as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:da00ae3981d2cd2a56a7eeff50e9a811b661ac2d005e93cf49589fc4acbc2f71_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:6d2b8446f3f2586debbc5c2a9e1d77604ba302c1b068f6d50dc0910f8e3c44ab_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:905c0573562dc43240258473f5d836dcf33bfacf57ef6c12239f99416484a093_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:e26aa71e117d2dbd8b4b359d5e68e0e597d97c63e7d2a3044a7ebb20f6a4434e_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:439a3481246ff065fcf623a720d02e671b498c35d8874712a7b65efd7674aa10_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:6252fed6343ac33e2cefbbbe80ad837c22de0f1f9fda1d52929540cb8b382ef5_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:63f94c92838c3aedab97b9a237354cab87f95230348a00de2a78eef6ea706090_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:03f62ccd2724e039a3c82abc044fd2fc6399b020d49fcffe8ca2115cdb3283d5_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:b5fe8ca59c91e0e74b6cbbe3fa97f6225d545d4c955578f9c647eea5a6fa6837_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:db4027b5d0bd38ad645ea5a72454c28ad6516b0f9ef170c95b7c17100291c1c8_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:598b3e4df08b2daff190795b13adff6b66ff58a3472429c959c110195accf2f2_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:924faa1ba7ec82740528805b51f1e925616ec4df04c752f787a7ac3a6f177913_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:cded59feeff43ee3e88b175e084e2808116bfc7acdab7177e77b8a47043e34c6_amd64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:a57a6aad5ac21c57c520fdb28bd64fb84496e769539a3f38575ea6968f9bab98_ppc64le as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:ab8f22e7b091287efcbfb6bdf84622373ac21bf0cfb5fee52cba208d5252f6da_arm64 as a component of Red Hat OpenShift AI 2.25
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:b44ab4412972a6d1962419c6b8074c1a797da4e4b17f20a963e600b963672ad0_amd64 as a component of Red Hat OpenShift AI 2.25
  • +170 more not shown

✅ Remediation

For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: To mitigate this issue, users should avoid processing Perceiver model files from untrusted or unverified sources. Ensure that all Perceiver model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing Transformer-XL model files from untrusted or unverified sources. Ensure that all Transformer-XL model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing megatron_gpt2 model files from untrusted or unverified sources. Ensure that all megatron_gpt2 model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing untrusted checkpoint files or visiting untrusted web pages with applications utilizing Hugging Face Accelerate. Restricting the sources of input data for affected components can significantly reduce the attack surface. No service restart is required for this operational control. Workaround: To mitigate this issue, users should avoid converting SEW model checkpoints from untrusted or unverified sources. Ensure that all SEW model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid converting SEW-D model checkpoints from untrusted or unverified sources. Ensure that all SEW-D model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid converting HuBERT model checkpoints from untrusted or unverified sources. Ensure that all HuBERT model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing X-CLIP model files from untrusted or unverified sources. Ensure that all X-CLIP model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: To mitigate this issue, users should avoid processing GLM4 model files from untrusted or unverified sources. Ensure that all GLM4 model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: To mitigate this issue, avoid loading Keras model archives from untrusted sources. If processing untrusted Keras model archives is unavoidable, ensure they are processed within an isolated and resource-constrained environment to limit the impact of potential memory exhaustion attacks. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modification or introduction of malicious code. Implement strict access controls and integrity checks for all model sources. Workaround: To mitigate this vulnerability, avoid enabling the `UPLOAD_KEEP_FILENAME=True` configuration option in applications using `python-multipart`. This option, when used with `UPLOAD_DIR`, allows an attacker to write files to arbitrary locations. Disabling or not configuring `UPLOAD_KEEP_FILENAME=True` prevents the path traversal vulnerability. Workaround: To mitigate this issue, restrict network access to the vLLM service to only trusted clients. Implement strict network segmentation for vLLM pods in containerized environments to limit potential lateral movement. Ensure that vLLM instances are not exposed to untrusted external networks without proper access controls and input validation at the perimeter.

🔗 References (37)