RHSA-2026:91245

Vulnerability from csaf_redhat - Published: 2026-10-27 19:03 - Updated: 2026-10-30 12:16
Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Spyre)
Severity
Critical
Notes
Topic: Red Hat AI Base Images 3.4.6 (Spyre) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-69418

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are not covered by the authentication tag, allowing an attacker to read or tamper with them without detection.

4.0 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-325 - Missing Cryptographic Step
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x —
Vendor Fix fix
Workaround
Threats
Impact Low
CVE-2026-6653

A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-11979

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-28390

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-31790

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-824 - Access of Uninitialized Pointer
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-34182

A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-130 - Improper Handling of Length Parameter Inconsistency
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-34183

A flaw was found in OpenSSL's QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-44172

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses `mysql_real_escape_string()` and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL commands, potentially leading to unauthorized data access or modification within the database.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-45445

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-1204 - Generation of Weak Initialization Vector (IV)
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-45447

A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-763 - Release of Invalid Pointer or Reference
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-86138

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-86140

A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.

7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-86142

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-86143

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-192 - Integer Coercion Error
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-86144

A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.

5.6 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-669 - Incorrect Resource Transfer Between Spheres
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Moderate
CVE-2026-86145

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-89161

A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.

7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-103111

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).

7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE-787 - Out-of-bounds Write
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Important
CVE-2026-114406

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 3 products, the same list as for CVE-2025-69418
Threats
Impact Critical
References
URL Category
https://access.redhat.com/errata/RHSA-2026:91245 self
https://access.redhat.com/security/cve/CVE-2025-69418 external
https://access.redhat.com/security/cve/CVE-2026-103111 external
https://access.redhat.com/security/cve/CVE-2026-114406 external
https://access.redhat.com/security/cve/CVE-2026-11979 external
https://access.redhat.com/security/cve/CVE-2026-13346 external
https://access.redhat.com/security/cve/CVE-2026-28390 external
https://access.redhat.com/security/cve/CVE-2026-31790 external
https://access.redhat.com/security/cve/CVE-2026-34182 external
https://access.redhat.com/security/cve/CVE-2026-34183 external
https://access.redhat.com/security/cve/CVE-2026-44172 external
https://access.redhat.com/security/cve/CVE-2026-45445 external
https://access.redhat.com/security/cve/CVE-2026-45447 external
https://access.redhat.com/security/cve/CVE-2026-6653 external
https://access.redhat.com/security/cve/CVE-2026-74860 external
https://access.redhat.com/security/cve/CVE-2026-86138 external
https://access.redhat.com/security/cve/CVE-2026-86140 external
https://access.redhat.com/security/cve/CVE-2026-86142 external
https://access.redhat.com/security/cve/CVE-2026-86143 external
https://access.redhat.com/security/cve/CVE-2026-86144 external
https://access.redhat.com/security/cve/CVE-2026-86145 external
https://access.redhat.com/security/cve/CVE-2026-89161 external
https://access.redhat.com/security/updates/classi… external
https://www.redhat.com/en/products/ai external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-69418 self
https://bugzilla.redhat.com/show_bug.cgi?id=2430381 external
https://www.cve.org/CVERecord?id=CVE-2025-69418 external
https://nvd.nist.gov/vuln/detail/CVE-2025-69418 external
https://access.redhat.com/security/cve/CVE-2026-6653 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491354 external
https://www.cve.org/CVERecord?id=CVE-2026-6653 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6653 external
https://bugs.launchpad.net/ubuntu/+source/libxml2… external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite… external
https://access.redhat.com/security/cve/CVE-2026-11979 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494191 external
https://www.cve.org/CVERecord?id=CVE-2026-11979 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11979 external
https://cert.pl/en/posts/2026/06/CVE-2026-11979 external
https://gitlab.gnome.org/GNOME/libxml2/-/commit/c… external
https://access.redhat.com/security/cve/CVE-2026-13346 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508514 external
https://www.cve.org/CVERecord?id=CVE-2026-13346 external
https://nvd.nist.gov/vuln/detail/CVE-2026-13346 external
https://github.com/pypa/pip/pull/14110 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-28390 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456314 external
https://www.cve.org/CVERecord?id=CVE-2026-28390 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28390 external
https://github.com/openssl/openssl/commit/01194a8… external
https://github.com/openssl/openssl/commit/2e39b7a… external
https://github.com/openssl/openssl/commit/af2a5fe… external
https://github.com/openssl/openssl/commit/ea7b4ea… external
https://github.com/openssl/openssl/commit/fd2f1a6… external
https://openssl-library.org/news/secadv/20260407.txt external
https://access.redhat.com/security/cve/CVE-2026-31790 self
https://bugzilla.redhat.com/show_bug.cgi?id=2451094 external
https://www.cve.org/CVERecord?id=CVE-2026-31790 external
https://nvd.nist.gov/vuln/detail/CVE-2026-31790 external
https://access.redhat.com/security/cve/CVE-2026-34182 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481884 external
https://www.cve.org/CVERecord?id=CVE-2026-34182 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34182 external
https://access.redhat.com/security/cve/CVE-2026-34183 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481885 external
https://www.cve.org/CVERecord?id=CVE-2026-34183 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34183 external
https://access.redhat.com/security/cve/CVE-2026-44172 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488459 external
https://www.cve.org/CVERecord?id=CVE-2026-44172 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44172 external
https://github.com/MariaDB/server/security/adviso… external
https://jira.mariadb.org/browse/CONC-819 external
https://access.redhat.com/security/cve/CVE-2026-45445 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481896 external
https://www.cve.org/CVERecord?id=CVE-2026-45445 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45445 external
https://access.redhat.com/security/cve/CVE-2026-45447 self
https://bugzilla.redhat.com/show_bug.cgi?id=2481898 external
https://www.cve.org/CVERecord?id=CVE-2026-45447 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45447 external
https://access.redhat.com/security/cve/CVE-2026-74860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2529697 external
https://www.cve.org/CVERecord?id=CVE-2026-74860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-74860 external
https://access.redhat.com/security/cve/CVE-2026-86138 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528986 external
https://www.cve.org/CVERecord?id=CVE-2026-86138 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86138 external
https://github.com/GNOME/libxml2/commit/a4cba4b5b… external
https://github.com/GNOME/libxml2/compare/v2.15.3.… external
https://access.redhat.com/security/cve/CVE-2026-86140 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528989 external
https://www.cve.org/CVERecord?id=CVE-2026-86140 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86140 external
https://github.com/GNOME/libxml2/commit/d1686f91d… external
https://access.redhat.com/security/cve/CVE-2026-86142 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528990 external
https://www.cve.org/CVERecord?id=CVE-2026-86142 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86142 external
https://github.com/GNOME/libxml2/commit/6b3a736c0… external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite… external
https://access.redhat.com/security/cve/CVE-2026-86143 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528987 external
https://www.cve.org/CVERecord?id=CVE-2026-86143 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86143 external
https://github.com/GNOME/libxml2/commit/90f293ba7… external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite… external
https://access.redhat.com/security/cve/CVE-2026-86144 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528992 external
https://www.cve.org/CVERecord?id=CVE-2026-86144 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86144 external
https://github.com/GNOME/libxml2/commit/b63cd517a… external
https://access.redhat.com/security/cve/CVE-2026-86145 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528993 external
https://www.cve.org/CVERecord?id=CVE-2026-86145 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86145 external
https://github.com/PCRE2Project/pcre2/releases/ta… external
https://github.com/PCRE2Project/pcre2/security/ad… external
https://access.redhat.com/security/cve/CVE-2026-89161 self
https://bugzilla.redhat.com/show_bug.cgi?id=2531747 external
https://www.cve.org/CVERecord?id=CVE-2026-89161 external
https://nvd.nist.gov/vuln/detail/CVE-2026-89161 external
https://github.com/PCRE2Project/pcre2/pull/937 external
https://access.redhat.com/security/cve/CVE-2026-103111 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543797 external
https://www.cve.org/CVERecord?id=CVE-2026-103111 external
https://nvd.nist.gov/vuln/detail/CVE-2026-103111 external
https://github.com/PCRE2Project/pcre2/security/ad… external
https://access.redhat.com/security/cve/CVE-2026-114406 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556046 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-114406 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114406 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Base Images 3.4.6 (Spyre) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Base Images",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:91245",
        "url": "https://access.redhat.com/errata/RHSA-2026:91245"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69418",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69418"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-103111",
        "url": "https://access.redhat.com/security/cve/CVE-2026-103111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-114406",
        "url": "https://access.redhat.com/security/cve/CVE-2026-114406"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11979",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11979"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13346",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13346"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28390",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28390"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
        "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34182",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34182"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34183",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34183"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44172",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44172"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45445",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45445"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45447",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6653",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6653"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-74860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-74860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86138",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86138"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86140",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86140"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86142",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86142"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86143",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86143"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86144",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86144"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86145",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86145"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-89161",
        "url": "https://access.redhat.com/security/cve/CVE-2026-89161"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai",
        "url": "https://www.redhat.com/en/products/ai"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91245.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Spyre)",
    "tracking": {
      "current_release_date": "2026-10-30T12:16:14+00:00",
      "generator": {
        "date": "2026-10-30T12:16:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:91245",
      "initial_release_date": "2026-10-27T19:03:19+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T19:03:19+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-27T19:03:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T12:16:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift AI 3.4",
                "product": {
                  "name": "Red Hat OpenShift AI 3.4",
                  "product_id": "Red Hat OpenShift AI 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_ai:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift AI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
                  "product_id": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-spyre-rhel9@sha256%3Aa94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-spyre-rhel9\u0026tag=1793042074"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
                  "product_id": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-spyre-rhel9@sha256%3Ab1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87?arch=ppc64le\u0026repository_url=registry.redhat.io/rhai/base-image-spyre-rhel9\u0026tag=1793042074"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x",
                  "product_id": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-spyre-rhel9@sha256%3Aea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d?arch=s390x\u0026repository_url=registry.redhat.io/rhai/base-image-spyre-rhel9\u0026tag=1793042074"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64 as a component of Red Hat OpenShift AI 3.4",
          "product_id": "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le as a component of Red Hat OpenShift AI 3.4",
          "product_id": "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x as a component of Red Hat OpenShift AI 3.4",
          "product_id": "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-69418",
      "cwe": {
        "id": "CWE-325",
        "name": "Missing Cryptographic Step"
      },
      "discovery_date": "2026-01-16T14:21:52.438000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430381"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. When applications directly call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are not covered by the authentication tag, allowing an attacker to read or tamper with them without detection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat products. In the Red Hat context, impact is limited because typical OpenSSL consumers using higher-level EVP APIs are not affected. The flaw only manifests when applications directly call low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths in hardware-accelerated builds. Additionally, TLS does not use OCB ciphersuites, and FIPS modules are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430381",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418"
        }
      ],
      "release_date": "2026-01-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls"
    },
    {
      "cve": "CVE-2026-6653",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-06-22T14:01:42.248415+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491354"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact use-after-free vulnerability in libxml2 can lead to a denial of service in Red Hat products that process untrusted XML input. In the worst-case scenario, a remote attacker is able to provide specially crafted XML, which, if parsed by an affected application, could cause the application to crash.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6653"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491354",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491354"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6653",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6653"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260",
          "url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"
        }
      ],
      "release_date": "2026-06-22T12:40:31.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nUpdating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free"
    },
    {
      "cve": "CVE-2026-11979",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-29T14:01:11.961973+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494191"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in libxml2 affects the `xmlcatalog` utility when operating in `--shell` mode. Exploitation requires an attacker to provide specially crafted, excessively long input, leading to stack-based buffer overflows. This vulnerability is limited to scenarios where an attacker can control input to the `xmlcatalog` utility, reducing its overall exposure in typical Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494191",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494191"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11979",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/06/CVE-2026-11979",
          "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"
        }
      ],
      "release_date": "2026-06-29T13:21:42.697000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow"
    },
    {
      "cve": "CVE-2026-13346",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-29T19:00:56.926395+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508514"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to arbitrary locations on the system, potentially leading to system compromise. This vulnerability primarily affects users utilizing the `pip download` command with the `--only-binary` option.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pip: pip: Arbitrary file installation via malicious package indexes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508514",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508514"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13346",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/pull/14110",
          "url": "https://github.com/pypa/pip/pull/14110"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/"
        }
      ],
      "release_date": "2026-07-29T18:33:50.820000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "pip: pip: Arbitrary file installation via malicious package indexes"
    },
    {
      "cve": "CVE-2026-28390",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-04-07T23:01:18.313921+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456314"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE has been rated as moderate by redhat because the vulnerability is limited to a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS processing, without evidence of memory corruption or code execution, furthermore the Affected functionality is niche. The vulnerable path requires:\nCMS/S/MIME processing,\nspecifically CMS_decrypt(),\nwith RSA-OAEP KeyTransportRecipientInfo.\nMany OpenSSL consumers never use CMS APIs, never process S/MIME,\nor do not decrypt attacker-controlled CMS objects.\nSo exposure is far narrower than a generic TLS parsing vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456314",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28390",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc",
          "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6",
          "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4",
          "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788",
          "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75",
          "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T22:00:54.172000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing"
    },
    {
      "cve": "CVE-2026-31790",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-25T02:59:10.179000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451094"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451094",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260407.txt",
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        }
      ],
      "release_date": "2026-04-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
    },
    {
      "cve": "CVE-2026-34182",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-05-27T13:59:43+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481884"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw in OpenSSL\u0027s Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34182"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481884",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34182",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages"
    },
    {
      "cve": "CVE-2026-34183",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-27T14:04:59+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481885"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL\u0027s QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate severity flaw exists in the QUIC PATH_CHALLENGE handler, allowing a remote attacker to exhaust heap memory of a QUIC client or server. By flooding the local QUIC stack with PATH_CHALLENGE frames, a malicious peer can trigger unbounded memory allocation, leading to a denial of service for applications utilizing the vulnerable QUIC implementation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481885",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, apply UDP rate limiting at your network edge to throttle malicious traffic. If QUIC is not strictly required, disable the listener entirely and configure your application to use standard TLS over TCP. Additionally, enforce strict process memory limits using cgroups to prevent host-wide memory exhaustion during an attack.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler"
    },
    {
      "cve": "CVE-2026-44172",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2026-06-12T18:01:33.248087+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488459"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in MariaDB server. An application processing non-validated user input, which then uses `mysql_real_escape_string()` and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL commands, potentially leading to unauthorized data access or modification within the database.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important SQL injection vulnerability in MariaDB server affecting applications that utilize `mysql_real_escape_string()` with non-validated user input and the `big5` character set. Exploitation allows a remote attacker to execute arbitrary SQL commands, potentially compromising data integrity and confidentiality within the database. The specific configuration required for exploitation limits its widespread impact, but systems configured in this manner are at significant risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44172"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488459",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44172",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44172"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44172",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44172"
        },
        {
          "category": "external",
          "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm",
          "url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm"
        },
        {
          "category": "external",
          "summary": "https://jira.mariadb.org/browse/CONC-819",
          "url": "https://jira.mariadb.org/browse/CONC-819"
        }
      ],
      "release_date": "2026-06-12T17:34:04.487000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()"
    },
    {
      "cve": "CVE-2026-45445",
      "cwe": {
        "id": "CWE-1204",
        "name": "Generation of Weak Initialization Vector (IV)"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL\u0027s EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path"
    },
    {
      "cve": "CVE-2026-45447",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-27T14:17:46+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481898"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This High severity heap use-after-free flaw in OpenSSL\u0027s PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481898",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447"
        }
      ],
      "release_date": "2026-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
    },
    {
      "cve": "CVE-2026-74860",
      "cwe": {
        "id": "CWE-763",
        "name": "Release of Invalid Pointer or Reference"
      },
      "discovery_date": "2026-09-08T07:16:42.486000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529697"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: double-free/UAF in libxml2 Python bindings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat evaluates this vulnerability as having an Important severity because memory corruption resulting from the use-after-free condition could allow remote execution of arbitrary code within the parsing application\u0027s process context. Under typical Red Hat Enterprise Linux deployments, the risk is scoped strictly to Python services that invoke libxml2 push parser interfaces and register custom attribute declaration callbacks on untrusted inputs. Standard C-based libxml2 consumers and applications using tree-based parsing without these specific Python SAX bindings are not exposed to this defect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529697",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860"
        }
      ],
      "release_date": "2026-03-08T09:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml2: double-free/UAF in libxml2 Python bindings"
    },
    {
      "cve": "CVE-2026-86138",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-09-05T04:31:00.379678+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528986"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528986",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
          "url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:21:53.127000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
    },
    {
      "cve": "CVE-2026-86140",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-09-05T04:41:05.796692+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
          "url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:26:13.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
    },
    {
      "cve": "CVE-2026-86142",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-09-05T04:41:08.714165+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528990"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528990",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
          "url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
        }
      ],
      "release_date": "2026-09-05T04:29:33.323000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
    },
    {
      "cve": "CVE-2026-86143",
      "cwe": {
        "id": "CWE-192",
        "name": "Integer Coercion Error"
      },
      "discovery_date": "2026-09-05T04:40:59.552825+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528987"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528987",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
          "url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
        }
      ],
      "release_date": "2026-09-05T04:31:21.187000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
    },
    {
      "cve": "CVE-2026-86144",
      "cwe": {
        "id": "CWE-669",
        "name": "Incorrect Resource Transfer Between Spheres"
      },
      "discovery_date": "2026-09-05T04:50:58.626617+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528992"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528992",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
          "url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:34:43.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
    },
    {
      "cve": "CVE-2026-86145",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-05T05:20:54.676360+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf",
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf"
        }
      ],
      "release_date": "2026-09-05T05:09:25.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches\u2014such as the reuse of cached memory workspaces\u2014enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions"
    },
    {
      "cve": "CVE-2026-89161",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-09-11T04:21:06.963234+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2531747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "RHBZ#2531747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/pull/937",
          "url": "https://github.com/PCRE2Project/pcre2/pull/937"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        }
      ],
      "release_date": "2026-09-11T04:11:51.666000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
    },
    {
      "cve": "CVE-2026-103111",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-30T04:40:56.869940+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
        },
        {
          "category": "external",
          "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
        }
      ],
      "release_date": "2026-09-30T04:13:59.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
    },
    {
      "cve": "CVE-2026-114406",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:01:55.916000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114406"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
        }
      ],
      "release_date": "2026-10-20T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:03:19+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:91245",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:91245"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:a94de5f76d3f798effb077e93f3e7baec41dab9a990382704595a1f1616f5eec_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:b1ddf787fafafdf06ef9b55ebf5b183aa27922ee57a2b320f52d227f6dd01a87_ppc64le",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:ea123cc98c4ea9ec937e48bb4fc05668dfe1eb8836fab56ab273a1704a313f5d_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.