RHSA-2026:98440
Vulnerability from csaf_redhat - Published: 2026-11-11 08:20 - Updated: 2026-11-13 12:55Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.5.7 (CUDA 12.9)
Severity
Important
Notes
Topic: Red Hat AI Base Images 3.5.7 (CUDA 12.9) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.
5.7 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Moderate
A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.
8.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.
8.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.
6.5 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Moderate
A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Moderate
A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.
7.4 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.
6.5 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Moderate
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
7.0 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in FFmpeg, specifically within the NVIDIA NVDEC hardware decoder. A remote attacker could exploit this double-free vulnerability by providing a specially crafted video file. This can lead to memory corruption, potentially allowing for arbitrary code execution or causing a denial of service in applications using FFmpeg's NVDEC hardware-accelerated decoding.
8.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in FFmpeg, specifically within the S/PDIF muxer. A remote attacker can exploit an out-of-bounds read vulnerability by providing a specially crafted DTS-HD audio stream during S/PDIF re-muxing. This allows the attacker to read memory beyond the intended buffer boundaries, potentially leading to information disclosure and denial of service.
7.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV (Windows Recorded TV Show) file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence of this vulnerability is potential memory corruption or arbitrary code execution.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in FFmpeg. A stack buffer overflow exists in the MPEG-PS muxer. A local attacker or a user processing a specially crafted file with an excessive number of streams could trigger this flaw, leading to a buffer overflow. This could potentially result in denial of service or arbitrary code execution.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in FFmpeg. Attackers can trigger memory corruption in the VC-2/Dirac RTP packetizer by supplying a specially crafted Dirac data unit. This heap buffer overflow occurs because the packetizer copies input data into a fixed-size buffer without proper size validation. This can lead to a denial of service.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in FFmpeg. A malicious or misconfigured DASH (Dynamic Adaptive Streaming over HTTP) server can exploit an out-of-bounds read vulnerability in the DASH demuxer. This occurs when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing a negative index to be used in the fragment retrieval function. Successful exploitation could lead to information disclosure or a denial of service.
8.1 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User interaction is required for exploitation.
7.5 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-1965
Threats
Impact
Important
References
136 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Base Images 3.5.7 (CUDA 12.9) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Base Images",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:98440",
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11856",
"url": "https://access.redhat.com/security/cve/CVE-2026-11856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13732",
"url": "https://access.redhat.com/security/cve/CVE-2026-13732"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1965",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3783",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64832",
"url": "https://access.redhat.com/security/cve/CVE-2026-64832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64833",
"url": "https://access.redhat.com/security/cve/CVE-2026-64833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70628",
"url": "https://access.redhat.com/security/cve/CVE-2026-70628"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75142",
"url": "https://access.redhat.com/security/cve/CVE-2026-75142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75144",
"url": "https://access.redhat.com/security/cve/CVE-2026-75144"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-75146",
"url": "https://access.redhat.com/security/cve/CVE-2026-75146"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8286",
"url": "https://access.redhat.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8458",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-88806",
"url": "https://access.redhat.com/security/cve/CVE-2026-88806"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8924",
"url": "https://access.redhat.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8927",
"url": "https://access.redhat.com/security/cve/CVE-2026-8927"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8932",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9547",
"url": "https://access.redhat.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai",
"url": "https://www.redhat.com/en/products/ai"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98440.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Base Images 3.5.7 (CUDA 12.9)",
"tracking": {
"current_release_date": "2026-11-13T12:55:59+00:00",
"generator": {
"date": "2026-11-13T12:55:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.6"
}
},
"id": "RHSA-2026:98440",
"initial_release_date": "2026-11-11T08:20:47+00:00",
"revision_history": [
{
"date": "2026-11-11T08:20:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-11T08:21:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-13T12:55:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift AI 3.5",
"product": {
"name": "Red Hat OpenShift AI 3.5",
"product_id": "Red Hat OpenShift AI 3.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_ai:3.5::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift AI"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"product": {
"name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"product_id": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/base-image-cuda-12.9-rhel9@sha256%3A1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-cuda-12.9-rhel9\u0026tag=1794259456"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64",
"product": {
"name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64",
"product_id": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64",
"product_identification_helper": {
"purl": "pkg:oci/base-image-cuda-12.9-rhel9@sha256%3A493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac?arch=arm64\u0026repository_url=registry.redhat.io/rhai/base-image-cuda-12.9-rhel9\u0026tag=1794259456"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64 as a component of Red Hat OpenShift AI 3.5",
"product_id": "Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64"
},
"product_reference": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"relates_to_product_reference": "Red Hat OpenShift AI 3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64 as a component of Red Hat OpenShift AI 3.5",
"product_id": "Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
},
"product_reference": "registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64",
"relates_to_product_reference": "Red Hat OpenShift AI 3.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-1965",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-03-11T11:00:54.752485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "RHBZ#2446448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.html",
"url": "https://curl.se/docs/CVE-2026-1965.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.json",
"url": "https://curl.se/docs/CVE-2026-1965.json"
}
],
"release_date": "2026-03-11T10:08:52.431000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication"
},
{
"cve": "CVE-2026-3783",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-03-11T11:01:01.429907+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "RHBZ#2446450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/2",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.html",
"url": "https://curl.se/docs/CVE-2026-3783.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.json",
"url": "https://curl.se/docs/CVE-2026-3783.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3583983",
"url": "https://hackerone.com/reports/3583983"
}
],
"release_date": "2026-03-11T10:09:08.746000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect"
},
{
"cve": "CVE-2026-8286",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-07-03T07:01:27.043110+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "RHBZ#2496763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.html",
"url": "https://curl.se/docs/CVE-2026-8286.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.json",
"url": "https://curl.se/docs/CVE-2026-8286.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3718195",
"url": "https://hackerone.com/reports/3718195"
}
],
"release_date": "2026-07-03T06:14:17.541000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
},
{
"cve": "CVE-2026-8458",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-07-03T07:01:30.042181+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Unauthorized connection reuse due to a logical error",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in libcurl where a logical error in connection pooling can lead to unauthorized connection reuse. When an application uses Negotiate authentication with different service names on the same hostname and port, libcurl might incorrectly reuse an existing authenticated connection for an unintended service. This could result in information disclosure or unauthorized access to resources, bypassing intended service isolation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "RHBZ#2496764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.html",
"url": "https://curl.se/docs/CVE-2026-8458.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.json",
"url": "https://curl.se/docs/CVE-2026-8458.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3721183",
"url": "https://hackerone.com/reports/3721183"
}
],
"release_date": "2026-07-03T06:14:42.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
},
{
"cve": "CVE-2026-8924",
"cwe": {
"id": "CWE-565",
"name": "Reliance on Cookies without Validation and Integrity Checking"
},
"discovery_date": "2026-07-03T07:01:32.981435+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496765"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl\u0027s cookie parsing logic. A malicious HTTP server can exploit this by setting \u0027super cookies\u0027 that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Cookie injection via malicious HTTP server using super cookies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: Red Hat rates this flaw Moderate (CVSS 6.5) compared to CISA\u0027s Critical (9.1). The scoring difference is due to two factors: first, exploitation requires the victim\u0027s curl to connect using a trailing-dot hostname (e.g., https://example.co.uk.), a format that is uncommon in practice and incompatible with TLS SNI; second, the direct impact is cookie injection into outbound requests \u2014 not exfiltration of victim data to the attacker. The curl project itself rates this flaw Low severity. Red Hat products that use curl for HTTP communication are affected, but the trailing-dot precondition significantly limits real-world exploitability. This flaw has not been shown to enable impacts beyond session integrity modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "RHBZ#2496765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8924.html",
"url": "https://curl.se/docs/CVE-2026-8924.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8924.json",
"url": "https://curl.se/docs/CVE-2026-8924.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733905",
"url": "https://hackerone.com/reports/3733905"
}
],
"release_date": "2026-07-03T06:15:04.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Cookie injection via malicious HTTP server using super cookies"
},
{
"cve": "CVE-2026-8927",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-03T07:01:44.730187+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496769"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Information disclosure due to uncleared proxy authentication state",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure vulnerability in libcurl arises when a handle is reused for sequential transfers with environment-variable proxy configurations, failing to clear the proxy authentication state. This oversight can lead to `Proxy-Authorization` headers being inadvertently sent to an incorrect proxy, potentially exposing sensitive authentication information in Red Hat environments utilizing multiple proxy configurations. This flaw leads only to a confidentiality impact. There has been no observed integrity impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8927"
},
{
"category": "external",
"summary": "RHBZ#2496769",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496769"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8927"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8927",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8927"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8927.html",
"url": "https://curl.se/docs/CVE-2026-8927.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8927.json",
"url": "https://curl.se/docs/CVE-2026-8927.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3744543",
"url": "https://hackerone.com/reports/3744543"
}
],
"release_date": "2026-07-03T06:16:06.376000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: Information disclosure due to uncleared proxy authentication state"
},
{
"cve": "CVE-2026-8932",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-07-03T07:01:15.122562+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings. This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity. This issue primarily affects applications that dynamically alter mTLS client certificate configurations and reuse connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "RHBZ#2496759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.html",
"url": "https://curl.se/docs/CVE-2026-8932.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.json",
"url": "https://curl.se/docs/CVE-2026-8932.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733910",
"url": "https://hackerone.com/reports/3733910"
}
],
"release_date": "2026-07-03T06:16:30.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse"
},
{
"cve": "CVE-2026-9547",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-07-03T07:01:12.182841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496758"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server\u0027s host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Man-in-the-middle attack via SSH host key bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where libcurl-based applications performing SCP or SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the one recorded in the known_hosts file, bypassing a critical host key verification and enabling potential man-in-the-middle attacks. The vulnerability requires specific application callback usage, not a general curl client default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "RHBZ#2496758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.html",
"url": "https://curl.se/docs/CVE-2026-9547.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.json",
"url": "https://curl.se/docs/CVE-2026-9547.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3751712",
"url": "https://hackerone.com/reports/3751712"
}
],
"release_date": "2026-07-03T06:18:44.499000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Man-in-the-middle attack via SSH host key bypass"
},
{
"cve": "CVE-2026-11856",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-03T07:01:38.848109+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496767"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When `libcurl` performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via incorrect Digest authentication header reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-severity flaw in `libcurl` can lead to information disclosure when an application reuses a `libcurl` handle for transfers to different HTTP origins while using Digest authentication. The vulnerability arises from `libcurl` incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information. The only observed impact from this flaw is an integrity impact.\n\n- libcurl only \u2014 the curl CLI is not affected\n- Requires an application to reuse an easy handle across different HTTP origins while Digest auth state is attached \u2014 a specific programming pattern\n- Credentials themselves are not leaked; only the authenticated state (\"Authorization: ...\" HTTP header)\n- Fixed in curl 8.21.0; affected range: 7.10.6 \u2013 8.20.0",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11856"
},
{
"category": "external",
"summary": "RHBZ#2496767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496767"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11856"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11856",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11856"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-11856.html",
"url": "https://curl.se/docs/CVE-2026-11856.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-11856.json",
"url": "https://curl.se/docs/CVE-2026-11856.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3793260",
"url": "https://hackerone.com/reports/3793260"
}
],
"release_date": "2026-07-03T06:13:31.661000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 \u2013 8.20.0",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via incorrect Digest authentication header reuse"
},
{
"acknowledgments": [
{
"names": [
"JD Marsters"
],
"organization": "Bhut Red"
}
],
"cve": "CVE-2026-13732",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-29T14:42:56.970000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GDB\u0027s STABS debug format parser. The\nread_member_functions() function in gdb/stabsread.c contains a linked\nlist removal bug in the code that separates destructor and non-destructor\nmember functions of C++ classes. The bug causes the destructor entries to\nremain in the main function list while the list length counter is\ndecremented, resulting in an out-of-bounds write when the function list\nis copied to its final allocated array. An attacker can craft an ELF\nbinary with malicious .stab and .stabstr sections that triggers this\nout-of-bounds write when a user opens the file in GDB and performs any\nsymbol-inspection operation such as setting a breakpoint. The inferior\nprocess does not need to be executed. Under controlled conditions, this\nwas demonstrated to achieve execution of arbitrary commands within the\nGDB process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects the STABS debug format parser in GDB, which is present\nand active in all currently supported Red Hat product streams that ship\nGDB. The STABS format is a legacy debug information format predating DWARF\nthat GDB parses automatically from .stab/.stabstr ELF sections. While GCC\nremoved STABS emitting support in GCC 13 and GDB deprecated STABS parsing\nin GDB 17, all deployed GDB versions parse STABS data without user opt-in.\nAn attacker can embed STABS sections in any ELF binary, including one\ncompiled with DWARF debug information, and GDB will parse both. The\nvulnerability requires the user to open the crafted binary in GDB and\nissue a symbol-inspection command, which is normal GDB usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13732"
},
{
"category": "external",
"summary": "RHBZ#2494416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13732"
}
],
"release_date": "2026-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "The following practices would help for avoiding exposure and mitigate this\nflaw:\n- Do not open untrusted or unknown ELF binaries in GDB without first\n stripping debug sections. Use `objcopy --remove-section=.stab\n --remove-section=.stabstr \u003cbinary\u003e` before debugging.\n- Use `readelf -S \u003cbinary\u003e | grep stab` to check for the presence of\n STABS sections before opening a binary in GDB. Legitimate modern\n binaries use DWARF, not STABS.\n- Consider using LLDB or other debuggers that do not support STABS for\n analysis of untrusted binaries.\n- For automated environments (CI, test farms) that invoke GDB on\n potentially untrusted binaries, run GDB in a sandboxed or containerized\n environment with restricted filesystem access.\n- GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected\n late 2026/2027) will remove STABS support entirely.\n- GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled\n binaries from recent GCC versions will not contain STABS data.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF"
},
{
"cve": "CVE-2026-64832",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-07-22T18:01:04.293127+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506189"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg, specifically within the NVIDIA NVDEC hardware decoder. A remote attacker could exploit this double-free vulnerability by providing a specially crafted video file. This can lead to memory corruption, potentially allowing for arbitrary code execution or causing a denial of service in applications using FFmpeg\u0027s NVDEC hardware-accelerated decoding.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This double-free vulnerability in FFmpeg\u0027s NVDEC hardware decoder can lead to arbitrary code execution when processing a specially crafted video file. The flaw affects Red Hat products that utilize FFmpeg with NVDEC hardware acceleration, including components within Community Projects and Red Hat OpenShift AI. Exploitation requires user interaction to process the malicious media, but successful attacks could result in significant system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64832"
},
{
"category": "external",
"summary": "RHBZ#2506189",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506189"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64832"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c",
"url": "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"
}
],
"release_date": "2026-07-22T17:01:16.181000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder"
},
{
"acknowledgments": [
{
"names": [
"Pavel Kohout"
],
"organization": "Aisle Research",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-64833",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-07-22T18:01:26.756260+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506192"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg, specifically within the S/PDIF muxer. A remote attacker can exploit an out-of-bounds read vulnerability by providing a specially crafted DTS-HD audio stream during S/PDIF re-muxing. This allows the attacker to read memory beyond the intended buffer boundaries, potentially leading to information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in the S/PDIF muxer (libavformat/spdifenc.c), which is compiled and shipped in all FFmpeg builds across these products. Exploitation requires an attacker to supply a crafted DTS audio stream during S/PDIF re-muxing, potentially leading to information disclosure and denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64833"
},
{
"category": "external",
"summary": "RHBZ#2506192",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506192"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64833"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c",
"url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"
}
],
"release_date": "2026-07-22T17:03:20.875000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer"
},
{
"cve": "CVE-2026-70628",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-08-06T22:24:06.054237+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2512243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV (Windows Recorded TV Show) file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence of this vulnerability is potential memory corruption or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is vulnerability in FFmpeg\u0027s DVB subtitle parser. While exploitation requires a local attacker to entice a user into processing a specially crafted WTV file, successful exploitation could lead to arbitrary code execution. This risk is elevated due to FFmpeg\u0027s common use in multimedia processing within Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70628"
},
{
"category": "external",
"summary": "RHBZ#2512243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70628"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70628",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70628"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897"
}
],
"release_date": "2026-08-06T21:24:15.825000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted WTV (Windows Recorded TV Show) files, especially those containing DVB subtitles. Exercise caution when handling multimedia files from unknown or suspicious sources.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-75142",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input"
},
"discovery_date": "2026-08-19T16:42:25.019264+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg. A stack buffer overflow exists in the MPEG-PS muxer. A local attacker or a user processing a specially crafted file with an excessive number of streams could trigger this flaw, leading to a buffer overflow. This could potentially result in denial of service or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in the MPEG-PS muxer (libavformat/mpegenc.c), which is compiled and shipped in all FFmpeg builds across these products. This is a stack buffer overflow triggered by input with an excessive number of streams.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75142"
},
{
"category": "external",
"summary": "RHBZ#2519759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75142"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c",
"url": "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c"
}
],
"release_date": "2026-08-19T16:24:57.738000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-75144",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input"
},
"discovery_date": "2026-08-19T16:42:45.319249+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519760"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg. Attackers can trigger memory corruption in the VC-2/Dirac RTP packetizer by supplying a specially crafted Dirac data unit. This heap buffer overflow occurs because the packetizer copies input data into a fixed-size buffer without proper size validation. This can lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c), which is compiled and shipped in all FFmpeg builds across these products. This is a heap buffer overflow that could potentially lead to code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75144"
},
{
"category": "external",
"summary": "RHBZ#2519760",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519760"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75144"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer",
"url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer"
}
],
"release_date": "2026-08-19T16:26:53.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-75146",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-08-19T16:43:42.004021+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FFmpeg. A malicious or misconfigured DASH (Dynamic Adaptive Streaming over HTTP) server can exploit an out-of-bounds read vulnerability in the DASH demuxer. This occurs when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing a negative index to be used in the fragment retrieval function. Successful exploitation could lead to information disclosure or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in the DASH demuxer (libavformat/dashdec.c), which is compiled and shipped in all FFmpeg builds across these products. Exploitation requires a malicious or misconfigured DASH server to serve a live manifest with a decreasing startNumber across a refresh.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75146"
},
{
"category": "external",
"summary": "RHBZ#2519764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75146"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75146",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75146"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0"
},
{
"category": "external",
"summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093",
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c",
"url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"
}
],
"release_date": "2026-08-19T16:28:19.356000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer"
},
{
"cve": "CVE-2026-88806",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-22T18:47:16.244674+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538514"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User interaction is required for exploitation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libX11: libX11: Heap-based buffer overflow via malicious X server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Important because an attacker operating a rogue or compromised X server can trigger memory corruption, potentially leading to arbitrary code execution with the permissions of the connecting client application. In typical Red Hat Enterprise Linux deployments, graphical applications communicate over trusted local sockets to the local display server, substantially restricting attack vectors. However, risk increases in scenarios where users connect to untrusted remote displays or employ unverified remote X11 session forwarding.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-88806"
},
{
"category": "external",
"summary": "RHBZ#2538514",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538514"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-88806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-88806"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88806",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88806"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309",
"url": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"
}
],
"release_date": "2026-09-21T13:42:12.700000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T08:20:47+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:98440",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:98440"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid connecting to untrusted X servers. When using SSH, ensure that X11 forwarding (`ssh -X` or `ssh -Y`) is only enabled for trusted remote hosts. To prevent X11 forwarding for specific hosts, add `ForwardX11 no` to the relevant host entry in `~/.ssh/config` or `/etc/ssh/ssh_config`. Alternatively, disable X11 forwarding globally by setting `ForwardX11 no` in `/etc/ssh/ssh_config`.",
"product_ids": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:1003a99a6bc111d833fa94c56c6b99f9adf23cf81693ebda9188e4fe2371574a_amd64",
"Red Hat OpenShift AI 3.5:registry.redhat.io/rhai/base-image-cuda-12.9-rhel9@sha256:493172c398ec4f133523bb69b8b198741f9e5246ab98efe3b4b1f83879cb02ac_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libX11: libX11: Heap-based buffer overflow via malicious X server"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.