Red Hat Security Advisory: Red Hat AI Inference 3.4.7 (ROCm)
Affects Red HatSource GCVE Database
Not known to be exploited.
Data as of 13 Nov 2026, 15:03 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 12 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponized
- A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
AI-suggested
Users should be aware of the risk and restrict code execution privileges in Python environments where possible. Monitoring and restricting access to the vulnerable PackageIndex.download() function or upgrading setuptools when a fix becomes available are recommended. Red Hat advises upgrading to supported product versions once fixes are released.
Description
CVE-2025-47273 is a path traversal vulnerability in the Python setuptools library used by Red Hat AI Inference. It allows attackers with limited code execution access to write files outside the intended temporary directory by manipulating package download URLs. This can lead to unauthorized overwrites of critical system files, potentially enabling persistent code execution or system misconfiguration. The vulnerability does not expose confidential information or require user interaction and does not inherently cause denial of service. Red Hat rates this vulnerability as moderate due to the required preconditions and limited scope of impact.
Impact
The vulnerability allows unauthorized file creation or overwriting within the same security boundary, risking persistent code execution, system misconfiguration, or unauthorized behavior. It does not expose confidential information or enable privilege escalation beyond the attacker's existing code execution rights. It does not inherently cause denial of service or availability impact. The attack vector requires low privileges but some code execution capability in a Python environment. The integrity impact is high, confidentiality impact is none, and availability impact is low according to Red Hat's assessment.
Summary
CVE-2025-47273 is a path traversal flaw in the setuptools PackageIndex.download() function that bypasses filename sanitization, allowing an attacker with limited code execution privileges in a Python environment to write files outside the intended temporary directory. This can overwrite critical configuration files, executables, or scripts, potentially leading to persistent code execution or unauthorized system behavior. Exploitation requires the attacker to have the ability to trigger the vulnerable function, such as via a script or automated job, but does not require full administrative rights. The vulnerability affects the integrity of the system within the same security boundary but does not allow crossing trust boundaries or access to existing files or confidential data.
Proofs of concept on GitHub
Public tooling indexed from Metasploit Framework, Exploit-DB, ProjectDiscovery nuclei-templates and PoC-in-GitHub. Its existence raises the odds of exploitation; it does not confirm attacks.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
- Path Traversal (opens in a new tab)
- Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
- Manipulating Web Input to File System Calls (opens in a new tab)
- Using Escaped Slashes in Alternate Encoding (opens in a new tab)
- Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-305Authentication Bypass by Primary Weakness (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-201Insertion of Sensitive Information Into Sent Data (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Requirements
Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
Implementation
Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere.
System Configuration
Setup default error messages so that unexpected errors do not disclose sensitive information.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…
Operation · Architecture and Design · Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-835Loop with Unreachable Exit Condition (Infinite Loop) (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-124Buffer Underwrite (Buffer Underrun) (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
Requirements
Choose a language that is not susceptible to these issues.
Implementation
All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1341Multiple Releases of Same Resource or Handle (opens in a new tab)
Base weakness
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Implementation · Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.
Implementation · Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-763Release of Invalid Pointer or Reference (opens in a new tab)
Base weakness
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Implementation
Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
Implementation
When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-908Use of Uninitialized Resource (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses or accesses a resource that has not been initialized.
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Implementation
Avoid race conditions (CWE-362) during initialization routines.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-694Use of Multiple Resources with Duplicate Identifier (opens in a new tab)
Base weakness
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
Architecture and Design
Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-248Uncaught Exception (opens in a new tab)
Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
An exception is thrown from a function, but it is not caught.
Requirements
The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
Requirements
A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
Implementation
Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-434Name not in the CWE catalogue (opens in a new tab)
- CWE-1046Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:99796
- Vendor Severity
- critical
- CVE Count
- 44
- Additional Cves
- CVE-2026-8286, CVE-2026-8458, CVE-2026-8927, CVE-2026-9547, CVE-2026-96640, CVE-2026-96643, CVE-2026-96644, CVE-2026-96778, CVE-2026-111064, CVE-2026-111066, CVE-2026-112390, CVE-2026-112391, CVE-2026-112392, CVE-2026-112397, CVE-2026-112399, CVE-2026-112400, CVE-2026-112402, CVE-2026-112404, CVE-2026-112405, CVE-2026-112406, CVE-2026-112892, CVE-2026-112893, CVE-2026-112894, CVE-2026-112895, CVE-2026-112896, CVE-2026-112897, CVE-2026-112902, CVE-2026-112940, CVE-2026-114050, CVE-2026-114051, CVE-2026-114055, CVE-2026-114109, CVE-2026-114406, CVE-2026-114605, CVE-2026-114613, CVE-2026-115915, CVE-2026-116177, CVE-2026-116179, CVE-2026-116180, CVE-2026-119194, CVE-2026-119195, CVE-2026-119196, CVE-2026-119197
References
- access.redhat.com/errata/RHSA-2026:99796 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-47273 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111064 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111066 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112390 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112391 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112392 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112397 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112399 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112400 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112402 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112404 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112405 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112406 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112892 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112893 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112894 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112895 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112896 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112897 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: Red Hat Developer Hub 1.10.7 releaseCriticalVulnerability
- Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.9 security updateHighVulnerability
- Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.7 security updateHighVulnerability
- Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.7 security updateHighVulnerability
- Red Hat Security Advisory: OpenShift Container Platform 4.13.73 bug fix and security updateHighVulnerability