RHSA-2026:6761HighCVSS 7.5

Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)

Published
April 7, 2026
Last Modified
August 24, 2026

🔗 CVE IDs covered (6)

CVE-2026-25048 →CVE-2026-28356 →CVE-2026-32981 →CVE-2025-68131 →CVE-2025-69227 →CVE-2025-69228 →

📋 Description

CVE-2025-68131 — cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse CVE-2025-69227 — aiohttp: aiohttp: Denial of Service via specially crafted POST request CVE-2025-69228 — aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request CVE-2026-25048 — xgrammar: xgrammar: Denial of Service via multi-level nested syntax CVE-2026-28356 — multipart: denial of service via maliciously crafted HTTP or multipart segment headers CVE-2026-32981 — ray: Ray Dashboard Path Traversal Leading to Local File Disclosure

🎯 Affected products3

  • Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:950e0d72a64f8a7b6414be2d9ab01ba8342a900e3b4c272295a3d63ef0a6d22c_amd64 as a component of Red Hat AI Inference Server 3.2
  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:e2fc16946f33c8e701f4eff7fc5de9910df865051de0141114cebd3e2c10f0aa_arm64 as a component of Red Hat AI Inference Server 3.2

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:6761 Workaround: To mitigate this issue, applications utilizing the `cbor2` library should avoid reusing `CBORDecoder` instances when processing data from different trust levels. If `CBORDecoder` reuse is unavoidable, ensure that sensitive data is not processed by a decoder instance that will subsequently handle untrusted input. This operational control prevents an attacker from accessing prior decoded information. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (10)