RHSA-2026:94473HighCVSS 8.1

Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (Spyre)

Published
November 3, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (2)

CVE-2026-96889 →CVE-2026-111497 →

📋 Description

CVE-2026-96889 — librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder

🎯 Affected products4

  • Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c85ca0ad750650605c4c5aa26dfc204e9100ebbbda1c5d5c55ee393ccd6bda4e_s390x as a component of Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:c864783ac6783307f62ddc246da3a1ed0d07d6a2386e107e001bb6a5aa6b096c_ppc64le as a component of Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:dfd7ad2c1ff32baad327786b0ceab184aaa27a8ef1dbd8f1fdf98cef49d89ef9_amd64 as a component of Red Hat OpenShift AI 3.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:94473 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (6)