RHSA-2026:94470HighCVSS 8.1

Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 13.0)

Published
November 3, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (2)

CVE-2026-96889 →CVE-2026-111497 →

📋 Description

CVE-2026-96889 — librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder

🎯 Affected products3

  • Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:b81f9f0d33a8d392a3acd7ffcf4bb733667370c83a15a7167c3e3a969798262e_amd64 as a component of Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:d9b231dec41f6b17c93a5a21c2cc8aae9ca2ad69e81039c38d773ba2fbb26fab_arm64 as a component of Red Hat OpenShift AI 3.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:94470 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (6)