RHSA-2026:91232

Vulnerability from csaf_redhat - Published: 2026-10-27 18:49 - Updated: 2026-10-30 08:15
Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CPU)
Severity
Critical
Notes
Topic: Red Hat AI Base Images 3.0.7 (CPU) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-8869

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2025-13327

A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2025-69418

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are not covered by the authentication tag, allowing an attacker to read or tamper with them without detection.

4.0 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-325 - Missing Cryptographic Step
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Low
CVE-2026-1703

A flaw was found in pip. A remote attacker could exploit this path traversal vulnerability by tricking a user into installing a maliciously crafted wheel archive. This could lead to files being extracted outside the intended installation directory, potentially disclosing sensitive information.

3.9 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Low
CVE-2026-6653

A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-8643

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.

8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-11979

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-28390

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-31790

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-824 - Access of Uninitialized Pointer
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-34182

A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-130 - Improper Handling of Length Parameter Inconsistency
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-34183

A flaw was found in OpenSSL's QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-45445

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-1204 - Generation of Weak Initialization Vector (IV)
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-45447

A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-55653

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-415 - Double Free
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-55655

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

5.0 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-59995

A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-59996

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the `scp` command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to data integrity issues or, in some cases, unauthorized access to sensitive information if files are stored in an exposed location.

4.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-59999

A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-60001

A flaw was found in OpenSSH's SSH daemon (sshd). A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attacker to guess valid credentials, potentially leading to unauthorized access or a denial of service.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-307 - Improper Restriction of Excessive Authentication Attempts
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-763 - Release of Invalid Pointer or Reference
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-86138

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-86140

A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.

7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-86142

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-86143

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-192 - Integer Coercion Error
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-86144

A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.

5.6 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-669 - Incorrect Resource Transfer Between Spheres
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Moderate
CVE-2026-86145

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-89161

A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.

7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-103111

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).

7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Important
CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 2 products, the same list as for CVE-2025-8869
Threats
Impact Critical
References
URL Category
https://access.redhat.com/errata/RHSA-2026:91232 self
https://access.redhat.com/security/cve/CVE-2025-13327 external
https://access.redhat.com/security/cve/CVE-2025-69418 external
https://access.redhat.com/security/cve/CVE-2025-8869 external
https://access.redhat.com/security/cve/CVE-2026-103111 external
https://access.redhat.com/security/cve/CVE-2026-114406 external
https://access.redhat.com/security/cve/CVE-2026-11979 external
https://access.redhat.com/security/cve/CVE-2026-13346 external
https://access.redhat.com/security/cve/CVE-2026-1703 external
https://access.redhat.com/security/cve/CVE-2026-28390 external
https://access.redhat.com/security/cve/CVE-2026-31790 external
https://access.redhat.com/security/cve/CVE-2026-34182 external
https://access.redhat.com/security/cve/CVE-2026-34183 external
https://access.redhat.com/security/cve/CVE-2026-45445 external
https://access.redhat.com/security/cve/CVE-2026-45447 external
https://access.redhat.com/security/cve/CVE-2026-55653 external
https://access.redhat.com/security/cve/CVE-2026-55655 external
https://access.redhat.com/security/cve/CVE-2026-59995 external
https://access.redhat.com/security/cve/CVE-2026-59996 external
https://access.redhat.com/security/cve/CVE-2026-59999 external
https://access.redhat.com/security/cve/CVE-2026-60001 external
https://access.redhat.com/security/cve/CVE-2026-6653 external
https://access.redhat.com/security/cve/CVE-2026-74860 external
https://access.redhat.com/security/cve/CVE-2026-86138 external
https://access.redhat.com/security/cve/CVE-2026-86140 external
https://access.redhat.com/security/cve/CVE-2026-86142 external
https://access.redhat.com/security/cve/CVE-2026-86143 external
https://access.redhat.com/security/cve/CVE-2026-86144 external
https://access.redhat.com/security/cve/CVE-2026-86145 external
https://access.redhat.com/security/cve/CVE-2026-8643 external
https://access.redhat.com/security/cve/CVE-2026-89161 external
https://access.redhat.com/security/updates/classi… external
https://www.redhat.com/en/products/ai external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-8869 self
https://bugzilla.redhat.com/show_bug.cgi?id=2397852 external
https://www.cve.org/CVERecord?id=CVE-2025-8869 external
https://nvd.nist.gov/vuln/detail/CVE-2025-8869 external
https://github.com/pypa/pip/pull/13550 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2025-13327 self
https://bugzilla.redhat.com/show_bug.cgi?id=2407263 external
https://www.cve.org/CVERecord?id=CVE-2025-13327 external
https://nvd.nist.gov/vuln/detail/CVE-2025-13327 external
https://github.com/astral-sh/uv external
https://github.com/astral-sh/uv/commit/da659fee48… external
https://github.com/astral-sh/uv/security/advisori… external
https://access.redhat.com/security/cve/CVE-2025-69418 self
https://bugzilla.redhat.com/show_bug.cgi?id=2430381 external
https://www.cve.org/CVERecord?id=CVE-2025-69418 external
https://nvd.nist.gov/vuln/detail/CVE-2025-69418 external
https://access.redhat.com/security/cve/CVE-2026-1703 self
https://bugzilla.redhat.com/show_bug.cgi?id=2436000 external
https://www.cve.org/CVERecord?id=CVE-2026-1703 external
https://nvd.nist.gov/vuln/detail/CVE-2026-1703 external
https://github.com/pypa/pip/commit/8e227a9be4faa9… external
https://github.com/pypa/pip/pull/13777 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-6653 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491354 external
https://www.cve.org/CVERecord?id=CVE-2026-6653 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6653 external
https://bugs.launchpad.net/ubuntu/+source/libxml2… external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite… external
https://access.redhat.com/security/cve/CVE-2026-8643 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460927 external
https://www.cve.org/CVERecord?id=CVE-2026-8643 external
https://nvd.nist.gov/vuln/detail/CVE-2026-8643 external
https://github.com/pypa/pip/commit/8eb178480bd1a2… external
https://access.redhat.com/security/cve/CVE-2026-11979 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494191 external
https://www.cve.org/CVERecord?id=CVE-2026-11979 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11979 external
https://cert.pl/en/posts/2026/06/CVE-2026-11979 external
https://gitlab.gnome.org/GNOME/libxml2/-/commit/c… external
https://access.redhat.com/security/cve/CVE-2026-13346 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508514 external
https://www.cve.org/CVERecord?id=CVE-2026-13346 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13346 external
https://github.com/pypa/pip/pull/14110 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-28390 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456314 external
https://www.cve.org/CVERecord?id=CVE-2026-28390 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28390 external
https://github.com/openssl/openssl/commit/01194a8… external
https://github.com/openssl/openssl/commit/2e39b7a… external
https://github.com/openssl/openssl/commit/af2a5fe… external
https://github.com/openssl/openssl/commit/ea7b4ea… external
https://github.com/openssl/openssl/commit/fd2f1a6… external
https://openssl-library.org/news/secadv/20260407.txt external
https://access.redhat.com/security/cve/CVE-2026-31790 self
https://bugzilla.redhat.com/show_bug.cgi?id=2451094 external
https://www.cve.org/CVERecord?id=CVE-2026-31790 external
https://nvd.nist.gov/vuln/detail/CVE-2026-31790 external
https://access.redhat.com/security/cve/CVE-2026-34182 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481884 external
https://www.cve.org/CVERecord?id=CVE-2026-34182 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34182 external
https://access.redhat.com/security/cve/CVE-2026-34183 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481885 external
https://www.cve.org/CVERecord?id=CVE-2026-34183 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34183 external
https://access.redhat.com/security/cve/CVE-2026-45445 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481896 external
https://www.cve.org/CVERecord?id=CVE-2026-45445 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45445 external
https://access.redhat.com/security/cve/CVE-2026-45447 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481898 external
https://www.cve.org/CVERecord?id=CVE-2026-45447 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45447 external
https://access.redhat.com/security/cve/CVE-2026-55653 self
https://bugzilla.redhat.com/show_bug.cgi?id=2462351 external
https://www.cve.org/CVERecord?id=CVE-2026-55653 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55653 external
https://access.redhat.com/security/cve/CVE-2026-55655 self
https://bugzilla.redhat.com/show_bug.cgi?id=2462250 external
https://www.cve.org/CVERecord?id=CVE-2026-55655 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55655 external
https://access.redhat.com/security/cve/CVE-2026-59995 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497927 external
https://www.cve.org/CVERecord?id=CVE-2026-59995 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59995 external
https://marc.info/?l=openssh-unix-dev&m=178333966… external
https://www.openssh.org/releasenotes.html#10.4p1 external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2026-59996 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497944 external
https://www.cve.org/CVERecord?id=CVE-2026-59996 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59996 external
https://access.redhat.com/security/cve/CVE-2026-59999 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497942 external
https://www.cve.org/CVERecord?id=CVE-2026-59999 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59999 external
https://access.redhat.com/security/cve/CVE-2026-60001 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497938 external
https://www.cve.org/CVERecord?id=CVE-2026-60001 external
https://nvd.nist.gov/vuln/detail/CVE-2026-60001 external
https://access.redhat.com/security/cve/CVE-2026-74860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2529697 external
https://www.cve.org/CVERecord?id=CVE-2026-74860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-74860 external
https://access.redhat.com/security/cve/CVE-2026-86138 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528986 external
https://www.cve.org/CVERecord?id=CVE-2026-86138 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86138 external
https://github.com/GNOME/libxml2/commit/a4cba4b5b… external
https://github.com/GNOME/libxml2/compare/v2.15.3.… external
https://access.redhat.com/security/cve/CVE-2026-86140 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528989 external
https://www.cve.org/CVERecord?id=CVE-2026-86140 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86140 external
https://github.com/GNOME/libxml2/commit/d1686f91d… external
https://access.redhat.com/security/cve/CVE-2026-86142 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528990 external
https://www.cve.org/CVERecord?id=CVE-2026-86142 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86142 external
https://github.com/GNOME/libxml2/commit/6b3a736c0… external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite… external
https://access.redhat.com/security/cve/CVE-2026-86143 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528987 external
https://www.cve.org/CVERecord?id=CVE-2026-86143 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86143 external
https://github.com/GNOME/libxml2/commit/90f293ba7… external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite… external
https://access.redhat.com/security/cve/CVE-2026-86144 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528992 external
https://www.cve.org/CVERecord?id=CVE-2026-86144 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86144 external
https://github.com/GNOME/libxml2/commit/b63cd517a… external
https://access.redhat.com/security/cve/CVE-2026-86145 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528993 external
https://www.cve.org/CVERecord?id=CVE-2026-86145 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86145 external
https://github.com/PCRE2Project/pcre2/releases/ta… external
https://github.com/PCRE2Project/pcre2/security/ad… external
https://access.redhat.com/security/cve/CVE-2026-89161 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531747 external
https://www.cve.org/CVERecord?id=CVE-2026-89161 external
https://nvd.nist.gov/vuln/detail/CVE-2026-89161 external
https://github.com/PCRE2Project/pcre2/pull/937 external
https://access.redhat.com/security/cve/CVE-2026-103111 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543797 external
https://www.cve.org/CVERecord?id=CVE-2026-103111 external
https://nvd.nist.gov/vuln/detail/CVE-2026-103111 external
https://github.com/PCRE2Project/pcre2/security/ad… external
https://access.redhat.com/security/cve/CVE-2026-114406 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556046 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-114406 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114406 external
Acknowledgments
Aisle.com
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Base Images 3.0.7 (CPU) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Base Images",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:91232",
        "url": "https://access.redhat.com/errata/RHSA-2026:91232"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-13327",
        "url": "https://access.redhat.com/security/cve/CVE-2025-13327"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69418",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69418"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-8869",
        "url": "https://access.redhat.com/security/cve/CVE-2025-8869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-103111",
        "url": "https://access.redhat.com/security/cve/CVE-2026-103111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-114406",
        "url": "https://access.redhat.com/security/cve/CVE-2026-114406"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11979",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11979"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13346",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13346"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-1703",
        "url": "https://access.redhat.com/security/cve/CVE-2026-1703"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28390",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28390"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
        "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34182",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34182"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34183",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34183"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45445",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45445"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45447",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55653",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55653"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55655",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55655"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59995",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59995"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59996",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59996"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59999",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59999"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-60001",
        "url": "https://access.redhat.com/security/cve/CVE-2026-60001"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6653",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6653"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-74860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-74860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86138",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86138"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86140",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86140"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86142",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86142"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86143",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86143"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86144",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86144"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86145",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86145"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-8643",
        "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-89161",
        "url": "https://access.redhat.com/security/cve/CVE-2026-89161"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai",
        "url": "https://www.redhat.com/en/products/ai"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91232.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CPU)",
    "tracking": {
      "current_release_date": "2026-10-30T08:15:25+00:00",
      "generator": {
        "date": "2026-10-30T08:15:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:91232",
      "initial_release_date": "2026-10-27T18:49:12+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T18:49:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-27T18:49:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T08:15:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift AI 3.0",
                "product": {
                  "name": "Red Hat OpenShift AI 3.0",
                  "product_id": "Red Hat OpenShift AI 3.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_ai:3.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift AI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
                  "product_id": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-cpu-rhel9@sha256%3A51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-cpu-rhel9\u0026tag=1793042072"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64",
                  "product_id": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-cpu-rhel9@sha256%3A57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825?arch=arm64\u0026repository_url=registry.redhat.io/rhai/base-image-cpu-rhel9\u0026tag=1793042072"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64 as a component of Red Hat OpenShift AI 3.0",
          "product_id": "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64 as a component of Red Hat OpenShift AI 3.0",
          "product_id": "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-8869",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2025-09-24T16:01:46.288976+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2397852"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn\u0027t implement PEP 706. Note that upgrading pip to a \"fixed\" version for this vulnerability doesn\u0027t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pip: pip missing checks on symbolic link extraction",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-8869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2397852",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397852"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-8869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-8869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-8869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8869"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/pull/13550",
          "url": "https://github.com/pypa/pip/pull/13550"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/"
        }
      ],
      "release_date": "2025-09-24T14:56:56.027000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python \u003e=3.9.17, source distributions (sdists) before installation as is already a best-practice.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "pip: pip missing checks on symbolic link extraction"
    },
    {
      "cve": "CVE-2025-13327",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2025-10-29T23:05:44.639284+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407263"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "uv: uv: Specially crafted ZIP archives lead to arbitrary code execution due to parsing differentials",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. It allows arbitrary code execution through specially crafted ZIP archives when using the `uv` tool to install attacker-controlled Python packages. Exploitation requires user interaction to initiate the package installation. This affects components within Red Hat AI Inference Server and Red Hat OpenShift AI.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13327"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407263",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407263"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13327",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13327"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13327",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13327"
        },
        {
          "category": "external",
          "summary": "https://github.com/astral-sh/uv",
          "url": "https://github.com/astral-sh/uv"
        },
        {
          "category": "external",
          "summary": "https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628",
          "url": "https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628"
        },
        {
          "category": "external",
          "summary": "https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64",
          "url": "https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64"
        }
      ],
      "release_date": "2025-10-29T22:12:57+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "uv: uv: Specially crafted ZIP archives lead to arbitrary code execution due to parsing differentials"
    },
    {
      "cve": "CVE-2025-69418",
      "cwe": {
        "id": "CWE-325",
        "name": "Missing Cryptographic Step"
      },
      "discovery_date": "2026-01-16T14:21:52.438000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430381"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. When applications directly call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are not covered by the authentication tag, allowing an attacker to read or tamper with them without detection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat products. In the Red Hat context, impact is limited because typical OpenSSL consumers using higher-level EVP APIs are not affected. The flaw only manifests when applications directly call low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in hardware-accelerated builds. Additionally, TLS does not use OCB ciphersuites, and FIPS modules are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430381",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418"
        }
      ],
      "release_date": "2026-01-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls"
    },
    {
      "cve": "CVE-2026-1703",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-02-02T16:00:55.704051+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pip. A remote attacker could exploit this path traversal vulnerability by tricking a user into installing a maliciously crafted wheel archive. This could lead to files being extracted outside the intended installation directory, potentially disclosing sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pip: pip: Information disclosure via path traversal when installing crafted wheel archives",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This LOW impact flaw in pip allows information disclosure via path traversal when installing crafted wheel archives. While files may be extracted outside the installation directory, the traversal is limited to prefixes of the installation directory, preventing injection or overwriting of executable files in typical Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1703"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1703",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1703"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1703",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1703"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735",
          "url": "https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/pull/13777",
          "url": "https://github.com/pypa/pip/pull/13777"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ/"
        }
      ],
      "release_date": "2026-02-02T14:43:02.919000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "pip: pip: Information disclosure via path traversal when installing crafted wheel archives"
    },
    {
      "cve": "CVE-2026-6653",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-06-22T14:01:42.248415+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491354"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact use-after-free vulnerability in libxml2 can lead to a denial of service in Red Hat products that process untrusted XML input. In the worst-case scenario, a remote attacker is able to provide specially crafted XML, which, if parsed by an affected application, could cause the application to crash.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6653"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491354",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491354"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6653",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6653"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260",
          "url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"
        }
      ],
      "release_date": "2026-06-22T12:40:31.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nUpdating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-8643",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-04-22T23:09:35+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in pip\u0027s wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user\u0027s permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb",
          "url": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb"
        }
      ],
      "release_date": "2026-05-27T17:03:36.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite"
    },
    {
      "cve": "CVE-2026-11979",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-29T14:01:11.961973+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494191"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in libxml2 affects the `xmlcatalog` utility when operating in `--shell` mode. Exploitation requires an attacker to provide specially crafted, excessively long input, leading to stack-based buffer overflows. This vulnerability is limited to scenarios where an attacker can control input to the `xmlcatalog` utility, reducing its overall exposure in typical Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494191",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494191"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11979",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/06/CVE-2026-11979",
          "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"
        }
      ],
      "release_date": "2026-06-29T13:21:42.697000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow"
    },
    {
      "cve": "CVE-2026-13346",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-29T19:00:56.926395+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508514"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pip: pip: Arbitrary file installation via malicious package indexes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508514",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508514"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13346",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/pull/14110",
          "url": "https://github.com/pypa/pip/pull/14110"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/"
        }
      ],
      "release_date": "2026-07-29T18:33:50.820000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "pip: pip: Arbitrary file installation via malicious package indexes"
    },
    {
      "cve": "CVE-2026-28390",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-04-07T23:01:18.313921+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456314"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE has been rated as moderate by redhat because the vulnerability is limited to a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS processing, without evidence of memory corruption or code execution, furthermore the Affected functionality is niche. The vulnerable path requires:\nCMS/S/MIME processing,\nspecifically CMS_decrypt(),\nwith RSA-OAEP KeyTransportRecipientInfo.\nMany OpenSSL consumers never use CMS APIs, never process S/MIME,\nor do not decrypt attacker-controlled CMS objects.\nSo exposure is far narrower than a generic TLS parsing vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456314",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28390",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc",
          "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6",
          "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4",
          "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788",
          "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75",
          "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T22:00:54.172000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing"
    },
    {
      "cve": "CVE-2026-31790",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-25T02:59:10.179000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451094"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451094",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
    },
    {
      "cve": "CVE-2026-34182",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-27T13:59:43+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481884"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34182"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481884",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34182",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages"
    },
    {
      "cve": "CVE-2026-34183",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-27T14:04:59+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481885"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL\u0027s QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate severity flaw exists in the QUIC PATH_CHALLENGE handler, allowing a remote attacker to exhaust heap memory of a QUIC client or server. By flooding the local QUIC stack with PATH_CHALLENGE frames, a malicious peer can trigger unbounded memory allocation, leading to a denial of service for applications utilizing the vulnerable QUIC implementation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481885",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, apply UDP rate limiting at your network edge to throttle malicious traffic. If QUIC is not strictly required, disable the listener entirely and configure your application to use standard TLS over TCP. Additionally, enforce strict process memory limits using cgroups to prevent host-wide memory exhaustion during an attack.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler"
    },
    {
      "cve": "CVE-2026-45445",
      "cwe": {
        "id": "CWE-1204",
        "name": "Generation of Weak Initialization Vector (IV)"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL\u0027s EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path"
    },
    {
      "cve": "CVE-2026-45447",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481898"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This High severity heap use-after-free flaw in OpenSSL\u0027s PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481898",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
    },
    {
      "acknowledgments": [
        {
          "organization": "Aisle.com",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-55653",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-04-26T18:54:39+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462351"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in OpenSSH affects clients operating in FIPS mode when negotiating Diffie-Hellman Group Exchange (DH-GEX) with a malicious SSH server. While it can lead to client process termination, resulting in a denial of service, the impact is limited to availability and does not result in broader system compromise. In order to exploit this vulnerability the attacker needs to trick the user to connect to an untrusted malicious server or compromise the server first. The availability impact is considered Low as the only impacted process is the single run of the SSH client trying to connect to the malicious server.\n\nThis vulnerability affects only the OpenSSH versions shipped with Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55653"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462351",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462351"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55653",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55653"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55653",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55653"
        }
      ],
      "release_date": "2026-06-22T23:17:43.088000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, OpenSSH clients operating in FIPS mode should avoid negotiating the `diffie-hellman-group-exchange-sha256` key exchange algorithm. This can be achieved by explicitly listing allowed key exchange algorithms in the client\u0027s SSH configuration file (e.g., `/etc/ssh/ssh_config` or `~/.ssh/config`), ensuring `diffie-hellman-group-exchange-sha256` is *not* included. For example, to use a subset of common algorithms, you might configure:\n\n```\nKexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\n```\n\n(Note: The above example `KexAlgorithms` list is illustrative and should be adjusted based on your environment\u0027s security requirements.)\n\nAdditionally, avoid using non-fatal client flows, such as `ssh-keyscan`, against untrusted SSH servers while FIPS mode is enabled. Changes to `ssh_config` will take effect for new SSH connections.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service"
    },
    {
      "acknowledgments": [
        {
          "organization": "Aisle.com",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-55655",
      "cwe": {
        "id": "CWE-923",
        "name": "Improper Restriction of Communication Channel to Intended Endpoints"
      },
      "discovery_date": "2026-04-26T18:39:13+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462250"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate severity flaw. The OpenSSH client in Red Hat Enterprise Linux is vulnerable to a local man-in-the-middle attack on X11 forwarding connections. Exploitation requires an attacker to have local unprivileged access on the client system and for X11 forwarding to be explicitly enabled and in use, which is not a default configuration. The attack can compromise the confidentiality of forwarded X11 traffic. This vulnerability doesn\u0027t affect the upstream OpenSSH versions and is restricted to the versions as shipped with Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55655"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462250",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462250"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55655",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55655"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55655"
        }
      ],
      "release_date": "2026-06-22T23:22:11.127000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable X11 forwarding on OpenSSH clients when it is not required. This can be achieved by avoiding the use of `-X` or `-Y` options when invoking `ssh`, or by setting `ForwardX11 no` in the SSH client configuration file (`~/.ssh/config` or `/etc/ssh/ssh_config`). Disabling X11 forwarding will prevent the client from attempting to establish X11 connections, thereby removing the attack vector.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions"
    },
    {
      "cve": "CVE-2026-59995",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-08T01:01:01.518880+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the \u0027sftp server:/path .\u0027 command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: sftp client allows attacker to control downloaded file location",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59995"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59995",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59995"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59995",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59995"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:04:49.995000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root).",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: sftp client allows attacker to control downloaded file location"
    },
    {
      "cve": "CVE-2026-59996",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-08T01:02:02.730076+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497944"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the `scp` command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to data integrity issues or, in some cases, unauthorized access to sensitive information if files are stored in an exposed location.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Conditions for Exploitation: Exploitation requires specific user actions and conditions, as the vulnerability only triggers when a user explicitly initiates a file copy between two remote destinations using the scp command. \n\nImpact Limitations: The boundaries of the potential impact are highly contained. The flaw only results in unintended file placement within the parent directory of the target destination. It does not inherently lead to arbitrary code execution, denial of service, or privilege escalation, and any potential data exposure relies heavily on the existing permissions of the parent directory.\n\nRed Hat Enterprise Linux (RHEL) versions 6, 7, and 8 are not affected by this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497944",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497944"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:07:07.759000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid performing `scp` operations directly between two remote destinations. Instead, consider copying files from the first remote host to a local machine, and then from the local machine to the second remote host. Alternatively, use `sftp` or `rsync` for remote file transfers, as these utilities are not affected by this specific vulnerability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy"
    },
    {
      "cve": "CVE-2026-59999",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-07-08T01:01:55.619428+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497942"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity flaw in OpenSSH `sshd` allows `PermitTunnel=yes` to override `DisableForwarding=yes`, potentially bypassing intended security controls. In Red Hat environments where `DisableForwarding` is used to restrict SSH session capabilities, an attacker who compromises a user\u0027s session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though `PermitTunnel` is not enabled by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59999"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497942",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497942"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59999",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59999"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59999",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59999"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:13:08.397000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy.\n\nAfter modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options"
    },
    {
      "cve": "CVE-2026-60001",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "discovery_date": "2026-07-08T01:01:40.680574+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497938"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH\u0027s SSH daemon (sshd). A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attacker to guess valid credentials, potentially leading to unauthorized access or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-60001"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497938",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497938"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-60001",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-60001"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60001",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60001"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:16:15.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay"
    },
    {
      "cve": "CVE-2026-74860",
      "cwe": {
        "id": "CWE-763",
        "name": "Release of Invalid Pointer or Reference"
      },
      "discovery_date": "2026-09-08T07:16:42.486000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529697"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: double-free/UAF in libxml2 Python bindings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat evaluates this vulnerability as having an Important severity because memory corruption resulting from the use-after-free condition could allow remote execution of arbitrary code within the parsing application\u0027s process context. Under typical Red Hat Enterprise Linux deployments, the risk is scoped strictly to Python services that invoke libxml2 push parser interfaces and register custom attribute declaration callbacks on untrusted inputs. Standard C-based libxml2 consumers and applications using tree-based parsing without these specific Python SAX bindings are not exposed to this defect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529697",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860"
        }
      ],
      "release_date": "2026-03-08T09:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml2: double-free/UAF in libxml2 Python bindings"
    },
    {
      "cve": "CVE-2026-86138",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-09-05T04:31:00.379678+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528986"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528986",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
          "url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:21:53.127000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
    },
    {
      "cve": "CVE-2026-86140",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-09-05T04:41:05.796692+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
          "url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:26:13.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
    },
    {
      "cve": "CVE-2026-86142",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-09-05T04:41:08.714165+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528990"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528990",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
          "url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
        }
      ],
      "release_date": "2026-09-05T04:29:33.323000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
    },
    {
      "cve": "CVE-2026-86143",
      "cwe": {
        "id": "CWE-192",
        "name": "Integer Coercion Error"
      },
      "discovery_date": "2026-09-05T04:40:59.552825+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528987"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528987",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
          "url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
        }
      ],
      "release_date": "2026-09-05T04:31:21.187000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
    },
    {
      "cve": "CVE-2026-86144",
      "cwe": {
        "id": "CWE-669",
        "name": "Incorrect Resource Transfer Between Spheres"
      },
      "discovery_date": "2026-09-05T04:50:58.626617+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528992"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528992",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
          "url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:34:43.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
    },
    {
      "cve": "CVE-2026-86145",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-05T05:20:54.676360+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf",
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf"
        }
      ],
      "release_date": "2026-09-05T05:09:25.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches\u2014such as the reuse of cached memory workspaces\u2014enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions"
    },
    {
      "cve": "CVE-2026-89161",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-09-11T04:21:06.963234+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/pull/937",
          "url": "https://github.com/PCRE2Project/pcre2/pull/937"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        }
      ],
      "release_date": "2026-09-11T04:11:51.666000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
    },
    {
      "cve": "CVE-2026-103111",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-30T04:40:56.869940+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
        }
      ],
      "release_date": "2026-09-30T04:13:59.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
    },
    {
      "cve": "CVE-2026-114406",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:01:55.916000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
          "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114406"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
        }
      ],
      "release_date": "2026-10-20T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T18:49:12+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91232",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91232"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51200bbd86f52481b4f45d28766d34646d52f76270b1a0a52a2cfaf2e316e83c_amd64",
            "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:57bc921a05826bb1fa0a48e7baa11c12237ad467fb74b8aa0adf2e8649993825_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.