Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA)
Affects Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · CVSS 6.5 Medium →: upgrade Red Hat pillow to 13.0.0 when convenient.
Data as of 4 Nov 2026, 06:43 UTC
Thin evidence
One scorer or none| CNA (GitHub_M) | CVSS 3.1 | 6.5 |
|---|
- Patch
- Available – fixed in 13.0.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
- Privileges Required: None
- The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
- User Interaction: Required
- Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
- Scope: Unchanged
- An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
- Confidentiality: None
- There is no loss of confidentiality within the impacted component.
- Integrity: None
- There is no loss of integrity within the impacted component.
- Availability: High
- There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 21 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponized
- A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Upgrade Pillow and pillow to 13.0.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| python-pillowPillow | Affected
| Fixed in
|
PyPIpillowpkg:pypi/pillowOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
No official fixes or mitigations are currently available for the vulnerabilities in Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA) as per the vendor advisory. For the related aiohttp cookie issue (CVE-2026-111063), Red Hat notes that typical environments enforce TLS/HTTPS, limiting exposure. No specific mitigation actions are recommended by Red Hat at this time.
Description
Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA) is referenced in a critical security advisory by Red Hat. The advisory lists numerous CVEs associated with the product but does not provide specific details or fixes for CVE-2026-96636 or related vulnerabilities. One related CVE (CVE-2026-111063) involves a low-severity flaw in aiohttp where the Secure attribute on shared cookies is not properly enforced, potentially exposing sensitive information over unencrypted connections. No fixes are currently available for the listed vulnerabilities in the AI Inference Model Optimization Tools. The advisory does not specify affected versions or mitigation steps beyond general awareness.
Impact
The advisory lists the vulnerabilities as critical but provides no detailed impact analysis for CVE-2026-96636 or related issues in the AI Inference Model Optimization Tools. The only detailed impact information is for CVE-2026-111063, which is low severity and involves potential sensitive information disclosure via cookies transmitted over unencrypted connections. There is no indication of active exploitation or system integrity or availability impact. The lack of fixes and mitigations suggests a potential risk if the vulnerabilities are exploitable, but no concrete exploitation details are provided.
Summary
The Red Hat security advisory for Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA) identifies multiple vulnerabilities, including CVE-2026-96636. However, the advisory does not provide detailed technical information or fixes for these vulnerabilities. A related CVE (CVE-2026-111063) describes a low-severity information disclosure issue in aiohttp due to improper enforcement of the Secure cookie attribute, which could allow cookies intended for encrypted transport to be sent over plaintext. This flaw requires specific conditions such as unencrypted transport and network interception to exploit and is rated low severity by Red Hat. The advisory states no fixes are currently available for the AI Inference Model Optimization Tools vulnerabilities, and no mitigation is provided. The vulnerabilities are noted as critical in severity but lack detailed impact or exploitation data.
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-190Integer Overflow or Wraparound (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-835Loop with Unreachable Exit Condition (Infinite Loop) (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
- OWASP Cheat Sheets
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-319Cleartext Transmission of Sensitive Information (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…
Operation · Architecture and Design · Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-348Use of Less Trusted Source (opens in a new tab)
Base weakness
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-444Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache.
Implementation
Use only SSL communication.
Implementation
Terminate the client session after each request.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-825Expired Pointer Dereference (opens in a new tab)
Base weakness
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Architecture and Design
Choose a language that provides automatic memory management.
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-124Buffer Underwrite (Buffer Underrun) (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
Requirements
Choose a language that is not susceptible to these issues.
Implementation
All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1341Multiple Releases of Same Resource or Handle (opens in a new tab)
Base weakness
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Implementation · Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.
Implementation · Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-763Release of Invalid Pointer or Reference (opens in a new tab)
Base weakness
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Implementation
Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
Implementation
When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-908Use of Uninitialized Resource (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses or accesses a resource that has not been initialized.
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Implementation
Avoid race conditions (CWE-362) during initialization routines.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-88Improper Neutralization of Argument Delimiters in a Command (Argument Injection) (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Implementation · Parameterization
Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command.
Architecture and Design · Input Validation
Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:94715
- Vendor Severity
- critical
- CVE Count
- 48
- Additional Cves
- CVE-2026-96637, CVE-2026-96638, CVE-2026-96639, CVE-2026-96640, CVE-2026-96641, CVE-2026-96642, CVE-2026-96643, CVE-2026-96644, CVE-2026-96778, CVE-2026-111063, CVE-2026-111064, CVE-2026-111065, CVE-2026-111066, CVE-2026-111748, CVE-2026-111750, CVE-2026-112390, CVE-2026-112391, CVE-2026-112392, CVE-2026-112393, CVE-2026-112394, CVE-2026-112395, CVE-2026-112396, CVE-2026-112397, CVE-2026-112398, CVE-2026-112399, CVE-2026-112400, CVE-2026-112401, CVE-2026-112402, CVE-2026-112403, CVE-2026-112404, CVE-2026-112405, CVE-2026-112406, CVE-2026-112891, CVE-2026-112892, CVE-2026-112893, CVE-2026-112894, CVE-2026-112895, CVE-2026-112896, CVE-2026-112897, CVE-2026-112898, CVE-2026-112899, CVE-2026-112900, CVE-2026-112901, CVE-2026-112902, CVE-2026-112940, CVE-2026-114406, CVE-2026-114501
References
- access.redhat.com/errata/RHSA-2026:94715 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111063 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111064 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111065 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111066 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111748 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111750 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112390 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112391 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112392 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112393 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112394 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112395 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112396 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112397 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112398 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112399 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112400 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112401 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-112402 (opens in a new tab)
Community reviews
Related threats
- CVE-2026-111063: AIOHTTP · Secure attribute not enforced for shared cookieMediumVulnerability
- CVE-2026-111063: AIOHTTP · Secure attribute not enforced for shared cookieMediumVulnerability
- CVE-2026-111063: AIOHTTP · Secure attribute not enforced for shared cookieMediumVulnerability
- CVE-2026-111063: AIOHTTP · Secure attribute not enforced for shared cookieMediumVulnerability
- CVE-2026-111063: AIOHTTP · Secure attribute not enforced for shared cookieMediumVulnerability