RHSA-2026:62336HighCVSS 9.1

Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.6 enhancement update

Published
September 1, 2026
Last Modified
September 3, 2026

🔗 CVE IDs covered (16)

CVE-2026-54058 →CVE-2026-59200 →CVE-2026-59205 →CVE-2026-59884 →CVE-2026-47155 →CVE-2026-53923 →CVE-2026-54060 →CVE-2026-55379 →CVE-2026-59199 →CVE-2026-41523 →CVE-2026-55380 →CVE-2026-59885 →CVE-2026-59886 →CVE-2026-34993 →CVE-2026-42338 →CVE-2026-59204 →

📋 Description

CVE-2026-34993 — aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() CVE-2026-41523 — vllm: vLLM: Arbitrary code execution via malicious HuggingFace model CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-47155 — vllm: vLLM: Supply-chain integrity issue due to inconsistent revision pinning controls CVE-2026-53923 — vllm: vLLM: Information disclosure via integer truncation CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API CVE-2026-59884 — python-pyasn1: pyasn1: Denial of Service via crafted BER input CVE-2026-59885 — pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

🎯 Affected products8

  • Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9@sha256:db445687f68381ba4348925b32b7782fb3424eefd0a6e58e200a9ad69685551a_amd64 as a component of Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9@sha256:82f19ded4eab2cd19f81187b2318897daa180a0edf04eaed9b45c3d9d27b2fe5_amd64 as a component of Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9@sha256:e78b6e0cc5eeb8a46beda69660499f08322fa0d59d382dcd1349af2a0e96e352_amd64 as a component of Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:5f4fc4b62366cd6599d914e31b51a35f7072ea4f5aaae077769b69a0c4cde849_arm64 as a component of Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:6689af3952e683d9a963a884b3b35979483560e6610fea0ccdda20d14ca51dee_amd64 as a component of Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9@sha256:7a63d3116445dfc773d9b004b4c31e2f3ee7ef244a783c2e3d16582e285b35e5_amd64 as a component of Red Hat Enterprise Linux AI 3.3
  • registry.redhat.io/rhelai3/bootc-rocm-rhel9@sha256:baba8ef26e81ee1cb529c894b5f0587588537de87d3a29267fc243812c29fa5a_amd64 as a component of Red Hat Enterprise Linux AI 3.3

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 Workaround: Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code. Workaround: Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a vLLM build containing the fix (>= 0.22.0) when available from Red Hat. Until then, only serve models from trusted registries, pin revisions explicitly, and review nested artifacts in model repositories before deployment. Workaround: No mitigation is required for unaffected deployments. Restrict untrusted access to inference APIs as a general hardening measure. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention. Workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk. Workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

🔗 References (21)