RHSA-2026:8748HighCVSS 8.8

Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)

Published
April 17, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (16)

CVE-2026-22695 →CVE-2026-25646 →CVE-2023-40403 →CVE-2025-14831 →CVE-2026-1299 →CVE-2026-4519 →CVE-2025-15366 →CVE-2026-22801 →CVE-2023-52356 →CVE-2025-13836 →CVE-2025-15367 →CVE-2026-2447 →CVE-2026-32597 →CVE-2026-0994 →CVE-2026-4111 →CVE-2026-27893 →

📋 Description

CVE-2023-40403 — libxslt: Processing web content may disclose sensitive information CVE-2023-52356 — libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service CVE-2025-13836 — cpython: Excessive read buffering DoS in http.client CVE-2025-14831 — gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification CVE-2025-15366 — cpython: IMAP command injection in user-controlled commands CVE-2025-15367 — cpython: POP3 command injection in user-controlled commands CVE-2026-0994 — python: protobuf: Protobuf: Denial of Service due to recursion depth bypass CVE-2026-1299 — cpython: email header injection due to unquoted newlines CVE-2026-2447 — libvpx: Heap buffer overflow in libvpx CVE-2026-4111 — libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive CVE-2026-4519 — python: Python: Command-line option injection in webbrowser.open() via crafted URLs CVE-2026-22695 — libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read CVE-2026-22801 — libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API CVE-2026-25646 — libpng: LIBPNG has a heap buffer overflow in png_set_quantize CVE-2026-27893 — vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting CVE-2026-32597 — pyjwt: PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation)

🎯 Affected products3

  • Red Hat AI Inference Server 3.3
  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 as a component of Red Hat AI Inference Server 3.3
  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 as a component of Red Hat AI Inference Server 3.3

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:8748 Workaround: Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads. Applications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit: ~~~ ... max_safe_read = 10 * 1024 * 1024 data = response.read(max_safe_read) ... ~~~ Workaround: To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters. Workaround: To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.

🔗 References (20)