RHSA-2026:76150HighCVSS 9.1

Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.4.5 security update

Published
October 5, 2026
Last Modified
October 6, 2026

🔗 CVE IDs covered (24)

CVE-2026-54058 →CVE-2026-54060 →CVE-2026-54283 →CVE-2026-55379 →CVE-2026-55380 →CVE-2026-5497 →CVE-2026-34993 →CVE-2026-48746 →CVE-2026-59197 →CVE-2026-59205 →CVE-2026-69244 →CVE-2026-44513 →CVE-2026-48526 →CVE-2026-48710 →CVE-2026-54234 →CVE-2026-55574 →CVE-2026-58659 →CVE-2026-59199 →CVE-2026-73556 →CVE-2026-45804 →CVE-2026-59200 →CVE-2026-59204 →CVE-2026-69243 →CVE-2026-44827 →

📋 Description

CVE-2026-5497 — vllm: vLLM: Denial of Service via unbounded video frame processing CVE-2026-34993 — aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() CVE-2026-44513 — Diffusers: Diffusers: Arbitrary remote code execution via trust_remote_code bypass CVE-2026-44827 — diffusers: Diffusers: Arbitrary Code Execution via malicious model loading CVE-2026-45804 — diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass CVE-2026-48526 — python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-48710 — starlette: Starlette: Security restriction bypass via malformed HTTP Host header CVE-2026-48746 — vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-54234 — vllm: vLLM: Denial of Service via malformed speculative decoding workload CVE-2026-54283 — starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-55574 — vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API CVE-2026-58659 — pytorch-lightning: PyTorch Lightning: Remote code execution via malicious checkpoint files CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API CVE-2026-69243 — aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade CVE-2026-69244 — aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses CVE-2026-73556 — vllm: vLLM: Denial of Service via Regular Expression processing

🎯 Affected products8

  • Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9@sha256:06b1e9b7df858121b6f339a5e78de93307be96c191a1c3e6df50cfeffaf9df15_amd64 as a component of Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9@sha256:698d9e34aaf479d0149ea75b841dacbe0117ba2e3718a7088ac98ea6b081792e_amd64 as a component of Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9@sha256:87723c21f48eb371968e2d68346953f2a03a3cf643a967801b84696ee3e1f1e8_amd64 as a component of Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:d6f218c203be6deafbe1b4915a577e9944d47821caff37250830a7606a4c87ce_arm64 as a component of Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:e0fbb896811ab54d183e23612030072b946674824bad697bf2b3f68362651662_amd64 as a component of Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9@sha256:c1a193fa047eedbbf52be0b1d0f5d52e3e572d144a871f7c9322a34ba5abd92f_amd64 as a component of Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/bootc-rocm-rhel9@sha256:8fe5203e86917e5f829bd64b831cad31536d23a213b4bfe31e652577ad0faf2e_amd64 as a component of Red Hat Enterprise Linux AI 3.4

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code. Workaround: Use DiffusionPipeline.from_pretrained() only with model paths, custom pipelines, and local snapshots from fully trusted and audited sources. Avoid setting custom_pipeline= to a Hub repository that differs from the primary model path unless its pipeline.py has been manually reviewed. When loading a local snapshot, check for unexpected *.py files at the snapshot root and under component subdirectories (unet/, scheduler/, etc.) before calling from_pretrained. The only complete fix is upgrading to diffusers 0.38.0. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes. If custom middleware is present, it should be updated to use `request.scope["path"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target. Workaround: Restrict network access to the vLLM API endpoint to only trusted clients and internal networks. Implement firewall rules or network policies to limit inbound connections to the vLLM service, thereby reducing the attack surface. This operational control helps prevent unauthorized external access to the vulnerable API. Workaround: To mitigate this issue, restrict network access to the vLLM inference engine's gRPC Generate and Abort endpoints. Configure firewall rules to limit incoming connections to trusted clients or internal networks only. This will prevent remote, unauthenticated attackers from sending malformed workloads and triggering a denial of service. If the service is exposed via a proxy or load balancer, ensure that access controls are in place at that layer. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.

🔗 References (29)