RHSA-2026:94702CriticalCVSS 8.2

Red Hat Security Advisory: Red Hat AI Inference 3.5.3 (CPU)

Published
November 3, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (60)

CVE-2026-111064 →CVE-2026-111066 →CVE-2026-111748 →CVE-2026-116180 →CVE-2026-111750 →CVE-2026-112891 →CVE-2026-114603 →CVE-2026-115915 →CVE-2026-111065 →CVE-2026-112397 →CVE-2026-112399 →CVE-2026-96642 →CVE-2026-111063 →CVE-2026-112390 →CVE-2026-112392 →CVE-2026-112406 →CVE-2026-112898 →CVE-2026-112902 →CVE-2026-116177 →CVE-2026-112940 →CVE-2026-114501 →CVE-2026-112394 →CVE-2026-96638 →CVE-2026-96640 →CVE-2026-112398 →CVE-2026-112892 →CVE-2026-112901 →CVE-2026-59951 →CVE-2026-112391 →CVE-2026-112893 →CVE-2026-112897 →CVE-2026-116176 →CVE-2026-116179 →CVE-2026-112395 →CVE-2026-112894 →CVE-2026-114053 →CVE-2026-96637 →CVE-2026-73556 →CVE-2026-94624 →CVE-2026-112402 →CVE-2026-112404 →CVE-2026-112895 →CVE-2026-112899 →CVE-2026-96644 →CVE-2026-112401 →CVE-2026-112896 →CVE-2026-96639 →CVE-2026-96643 →CVE-2026-112405 →CVE-2026-114406 →CVE-2026-96778 →CVE-2026-112900 →CVE-2026-96641 →CVE-2026-93592 →CVE-2026-112396 →CVE-2026-112393 →CVE-2026-112403 →CVE-2026-96636 →CVE-2026-100650 →CVE-2026-112400 →

📋 Description

CVE-2026-59951 — mcp: mcp: Denial of Service via session memory exhaustion in streamable HTTP servers CVE-2026-73556 — vllm: vLLM: Denial of Service via Regular Expression processing CVE-2026-93592 — vllm: vLLM: Denial of Service via negative token ID input CVE-2026-94624 — vllm: vLLM: Denial of Service via unbounded P2P KV offloading sessions CVE-2026-96636 — pillow: pillow: Denial of Service via decompression bomb check bypass in multi-frame images CVE-2026-96637 — pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images CVE-2026-96638 — pillow: pillow: Denial of Service via crafted RLE BMP image CVE-2026-96639 — pillow: Pillow multi-frame loaders can reuse stale native image storage after mode transitions CVE-2026-96640 — pillow: pillow: Denial of Service via duplicate page references in PDF files CVE-2026-96641 — pillow: pillow: Denial of Service via integer overflow in text-width calculation CVE-2026-96642 — pillow: Pillow: Denial of Service via negative archive member size in TarIO CVE-2026-96643 — pillow: pillow: Denial of Service via repeated EXIF headers CVE-2026-96644 — pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser CVE-2026-96778 — pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow CVE-2026-100650 — vllm: vLLM: Denial of Service via unbounded media ingestion CVE-2026-111063 — aiohttp: aiohttp: Information disclosure via unenforced Secure attribute on shared cookies CVE-2026-111064 — aiohttp: aiohttp: Denial of Service via missing initial request timeout CVE-2026-111065 — aiohttp: aiohttp: Denial of Service via Max-Age processing overflow CVE-2026-111066 — aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing CVE-2026-111748 — aiohttp: aiohttp: Security control bypass via request scheme spoofing CVE-2026-111750 — aiohttp: aiohttp: HTTP request smuggling via ambiguous request framing CVE-2026-112390 — pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing CVE-2026-112391 — pillow: Pillow: Denial of Service via unbounded recursion in PDF parser CVE-2026-112392 — pillow: pillow: Denial of Service via zero-size images in rank filters CVE-2026-112393 — pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO CVE-2026-112394 — pillow: pillow: Information disclosure via out-of-bounds read in raw decoders CVE-2026-112395 — pillow: pillow: Information disclosure via crafted tiled TIFF image CVE-2026-112396 — pillow: pillow: arbitrary code execution via heap use-after-free during TIFF encoding CVE-2026-112397 — pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images CVE-2026-112398 — pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution CVE-2026-112399 — pillow: pillow: Denial of service via crafted APNG image CVE-2026-112400 — pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image CVE-2026-112401 — pillow: pillow: Denial of Service via crafted GIF comments CVE-2026-112402 — pillow: pillow: Denial of service via double free during image transformation CVE-2026-112403 — pillow: Pillow: Heap buffer overflow in ImagingJpegDecode CVE-2026-112404 — pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding CVE-2026-112405 — pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() CVE-2026-112406 — pillow: pillow: Denial of Service via infinite loop during PDF page rewriting CVE-2026-112891 — pillow: pillow: Denial of Service via large GIF comments CVE-2026-112892 — pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder CVE-2026-112893 — pillow: Pillow: Denial of Service via invalid pointer free during font rendering CVE-2026-112894 — pillow: pillow: Denial of Service via crafted multi-frame image conversion CVE-2026-112895 — pillow: pillow: Denial of service via crafted PDF during append operations CVE-2026-112896 — pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder CVE-2026-112897 — pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding CVE-2026-112898 — pillow: Pillow: Information disclosure via empty palette quantization CVE-2026-112899 — Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit CVE-2026-112900 — pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE CVE-2026-112901 — pillow: Pillow: Denial of Service via crafted XBM image header CVE-2026-112902 — Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags CVE-2026-112940 — filelock: filelock: Arbitrary file overwrite via insecure database file reopening CVE-2026-114053 — vllm: vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114501 — pillow: Pillow: Information disclosure via improper memory alignment during Arrow export CVE-2026-114603 — opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing CVE-2026-115915 — vllm: vllm: Arbitrary code execution via unrestricted image format parsing CVE-2026-116176 — vllm: vllm: Information disclosure via SSRF in X-Request-Id header CVE-2026-116177 — vllm: vllm: Denial of Service via unconstrained image decompression CVE-2026-116179 — vllm: vLLM: Denial of Service via video frame limit bypass CVE-2026-116180 — vllm: vLLM: Denial of Service via uninitialized log probability tensors

🎯 Affected products2

  • Red Hat AI Inference Server 3.5
  • registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:f6c41a23b28f4ca0a19c6907a7d3ddbdfbecbe960e5665e8d70fb084135a41ec_amd64 as a component of Red Hat AI Inference Server 3.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:94702 Workaround: Restrict access to the inference service or filter requests at an upstream reverse proxy or API gateway: 1. Limit network access: Deploy firewall rules or OpenShift NetworkPolicies so that the inference server ports and endpoints are accessible only by authenticated, trusted internal clients. 2. Ingress request validation: Configure an API gateway or reverse proxy placed in front of the model server to inspect request payloads for the `/v1/embeddings` and `/pooling` endpoints, rejecting requests where the `input` array contains negative numbers, or restricting untrusted clients to submitting text prompt strings rather than raw token lists. Caveats: Inspecting request bodies at an intermediary gateway layer may introduce slight processing latency. Modifying reverse proxy rules or applying network policies may require a service configuration reload or restart, which can temporarily disrupt in-flight connections. Workaround: To mitigate this issue, avoid configuring vLLM's OffloadingConnector with TieringOffloadingSpec and a peer-to-peer secondary tier if not essential for your deployment. If this configuration is required, restrict network access to the vLLM instance to only trusted clients and internal networks to prevent unauthenticated attackers from reaching the vulnerable service. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Limit network exposure to the vLLM inference service and block outbound network connections from the serving host or container to prevent fetching untrusted external media: 1. Restrict inbound access using firewall rules so only trusted client networks or API gateways can reach the inference port (e.g., port 8000): # firewall-cmd --zone=public --remove-port=8000/tcp --permanent # firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> --permanent # firewall-cmd --reload 2. In OpenShift AI environments, apply a Kubernetes NetworkPolicy to the pod namespace to restrict ingress traffic strictly to authorized proxy pods, and apply an egress rule that blocks outbound internet access, preventing the service from downloading arbitrary remote media URLs. 3. Enforce maximum request body size limits on upstream reverse proxies or ingress controllers to drop oversized inline base64 payloads before forwarding requests to the inference backend. Caveats: Restricting egress traffic will prevent valid remote media references from being processed if external multi-modal inputs are expected. Modifying firewall rules or reloading network services may briefly interrupt active connections. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce initial keep-alive timeouts and first-request deadlines on newly established HTTP connections within aiohttp: upgrade to aiohttp 3.14.4 (or the fixed Ansible Automation Platform 24/Lightspeed Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Python3.11 Aiohttp/Koku/Exploit Intelligence/Vulnerability Analysis Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhaiis/Vllm Spyre Rhel/Rhaiis/Vllm Tpu Rhel/Cloudservices/Vulnerability Engine App/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 24/Controller Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Cloudservices/Insights Engine/Rhoai/Odh Ml Pipelines Runtime Generic Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Ta Lmes Job Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Automation Controller/Cloudservices/Floorist/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Model Registry Job Async Upload Rhel/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Rhoai/Odh Openvino Model Server Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Ask Sre/Rhelai3/Bootc Gaudi Rhel/Ansible Automation Platform Tech Preview/Ee Minimal Rhel/Rhoai/Odh Training Cuda121 Torch24 Py311 Rhel/Rhoai/Odh Training Cuda124 Torch25 Py311 Rhel/Rhoai/Odh Training Cuda128 Torch28 Py312 Rhel/Rhoai/Odh Training Rocm62 Torch24 Py311 Rhel/Rhoai/Odh Training Rocm62 Torch25 Py311 Rhel/Rhoai/Odh Training Rocm64 Torch28 Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Astro Virtual Assistant V/Lightspeed Core/Lightspeed Stack Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Mta/Mta Solution Server Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Mlserver Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Pipeline Runtime Minimal Cpu Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Minimal Rocm Py312 Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform 25/Controller Rhel/Ansible Automation Platform 25/Lightspeed Rhel/Ansible Automation Platform 26/Ansible Dev Tools Rhel/Ansible Automation Platform 26/Controller Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 26/De Supported Rhel/Ansible Automation Platform 26/Ee Minimal Rhel/Ansible Automation Platform 26/Ee Supported Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 26/Lightspeed Rhel/Ansible Automation Platform 26/Platform Resource Runner Rhel/Ansible Automation Platform 27/Controller Rhel/Ansible Automation Platform 27/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 27/Ee Control Plane Rhel/Ansible Automation Platform 27/Ee Minimal Rhel/Ansible Automation Platform 27/Ee Supported Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Lightspeed Rhel/Ansible Automation Platform 27/Platform Resource Runner Rhel/Ansible Automation Platform/Ee Minimal Rhel/Galaxy Ng/Automation Hub Container/Redhat User Workloads/Ansible Saas Ee/Ansible On Clouds/Gh Action Runner/Ansible Ai Connect Service/Insights Engine/Cloudservices/Sub…

🔗 References (64)