Threats Tagged 'cve-2026-5241'

Red Hat OpenShift AI 3.4.5 is a security advisory release that addresses multiple critical vulnerabilities identified by various CVEs including CVE-2025-61162. The advisory announces updated images for Red Hat OpenShift AI but does not provide specific details about the vulnerabilities or fixes in the release notes. Users are directed to official Red Hat documentation for upgrade instructions. No explicit patch details or affected versions are provided in the advisory content.

CVE-2026-5241 is a high-severity vulnerability in Red Hat AI Inference Server 3.4.5 (spyre) affecting the mlx-lm product, specifically in the huggingface/transformers LightGlue model loading path. It allows arbitrary code execution during model initialization. The vulnerability has a CVSS score of 8.0 and requires user interaction with high attack complexity. No known exploits in the wild have been reported. The Red Hat advisory lists this CVE among multiple others affecting the product but does not provide specific patch or fix details.

Multiple security vulnerabilities have been identified in Red Hat AI Inference Server versions 3.4.0 through 3.4.5 (rocm). These vulnerabilities are collectively addressed in Red Hat Security Advisory RHSA-2026:69469. The advisory lists numerous CVEs affecting this product version range. No specific fixes or patches are currently provided in the advisory.

Red Hat AI Inference Server 3.4.5 (cuda) has been identified with multiple security vulnerabilities, including CVE-2026-5241. The Red Hat advisory confirms the release of version 3.4.5 but does not list any fixes for these vulnerabilities. The advisory provides references and contact information but does not specify remediation steps or patches. The vulnerabilities are considered high severity based on the advisory classification.

Red Hat AI Inference Server 3.4.5 (cpu) has a security advisory issued by Red Hat Product Security addressing multiple vulnerabilities including CVE-2026-5241. The advisory lists numerous CVEs affecting the product but does not provide specific technical details or patches. No fixes are currently available as per the vendor advisory.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for librsvg fixes the following issues: Update to version 2.60.2: - CVE-2024-12224: Fixed idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243867). - CVE-2024-43806: Fixed memory explosion in rustix (bsc#1229950).

Release of RHOAI 3.4.2 provides these changes:

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.