Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda)
CVE-2026-25645 is a moderate severity vulnerability affecting the Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda). It involves a flaw in the requests HTTP library's extract_zipped_paths() function, which loads Certificate Authority bundles. A local attacker can exploit this by pre-creating a malicious CA bundle in the system's temporary directory, causing the application to load the malicious file and potentially bypass security controls. No fix is currently available that meets Red Hat's criteria for deployment and stability.
AI Analysis
Technical Summary
The vulnerability CVE-2026-25645 affects the requests HTTP library used by Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda). Specifically, the requests.utils.extract_zipped_paths() function, responsible for loading Certificate Authority bundles, can be tricked by a local attacker who pre-creates a malicious CA bundle file in the system's temporary directory. When a vulnerable application initializes the requests library, it may load this malicious CA bundle instead of the legitimate one, resulting in a security bypass and potential integrity compromise. The issue is related to CWE-379 (Creation of Temporary File in Directory with Insecure Permissions). Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, applicability, or stability.
Potential Impact
The vulnerability allows a local attacker to bypass security controls by causing the application to load a malicious Certificate Authority bundle instead of the legitimate one. This can compromise the integrity of security mechanisms relying on trusted CA bundles. Confidentiality and availability impacts are not indicated. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat currently does not offer a fix or mitigation that meets their criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Since no official fix or mitigation is available, applying workarounds or upgrading to a fixed version when released is recommended. Customers with a Technical Account Manager (TAM) can consult directly for guidance.
Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda)
Description
CVE-2026-25645 is a moderate severity vulnerability affecting the Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda). It involves a flaw in the requests HTTP library's extract_zipped_paths() function, which loads Certificate Authority bundles. A local attacker can exploit this by pre-creating a malicious CA bundle in the system's temporary directory, causing the application to load the malicious file and potentially bypass security controls. No fix is currently available that meets Red Hat's criteria for deployment and stability.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-25645 affects the requests HTTP library used by Red Hat AI Inference Model Optimization Tools 3.4.4 (cuda). Specifically, the requests.utils.extract_zipped_paths() function, responsible for loading Certificate Authority bundles, can be tricked by a local attacker who pre-creates a malicious CA bundle file in the system's temporary directory. When a vulnerable application initializes the requests library, it may load this malicious CA bundle instead of the legitimate one, resulting in a security bypass and potential integrity compromise. The issue is related to CWE-379 (Creation of Temporary File in Directory with Insecure Permissions). Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, applicability, or stability.
Potential Impact
The vulnerability allows a local attacker to bypass security controls by causing the application to load a malicious Certificate Authority bundle instead of the legitimate one. This can compromise the integrity of security mechanisms relying on trusted CA bundles. Confidentiality and availability impacts are not indicated. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat currently does not offer a fix or mitigation that meets their criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Since no official fix or mitigation is available, applying workarounds or upgrading to a fixed version when released is recommended. Customers with a Technical Account Manager (TAM) can consult directly for guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:57383
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a8af9a4acd9273b49f32f56
Added to database: 08/23/2026, 13:46:12 UTC
Last enriched: 08/23/2026, 13:51:23 UTC
Last updated: 08/24/2026, 02:29:17 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.