Threats Tagged 'cve-2026-54283'

Red Hat AI Inference 3.4.5 (rocm) includes multiple security vulnerabilities, including CVE-2026-34993, which affects the AIOHTTP Python framework. This vulnerability allows potential arbitrary code execution when untrusted input is loaded via the CookieJar.load() function. Exploitation requires an application to be configured to load attacker-controlled files, which is not typical in default Red Hat deployments. No official fixes are currently available for these vulnerabilities in Red Hat AI Inference 3.4.5 (rocm).

Red Hat AI Inference 3.4.5 (cuda) is referenced in a security advisory listing multiple CVEs including CVE-2026-5241. The advisory does not provide specific details or fixes for CVE-2026-5241 itself. One related vulnerability, CVE-2026-34993 in the AIOHTTP Python framework, allows potential arbitrary code execution via untrusted input to the CookieJar.load() function, but exploitation requires specific application configurations. No official patch or fix is currently provided for Red Hat AI Inference 3.4.5 (cuda) regarding these vulnerabilities.

A security advisory for Red Hat AI Inference 3.4.5 (cpu) addresses multiple vulnerabilities including CVE-2026-34993, which involves a flaw in the AIOHTTP Python asynchronous HTTP framework. This flaw allows potential arbitrary code execution when untrusted input is loaded via the CookieJar.load() function. Exploitation requires an application to be configured to process attacker-controlled files, which is not common in default Red Hat deployments. The advisory does not list any fixes currently available for these vulnerabilities.

CVE-2026-5241 is one of multiple vulnerabilities affecting Red Hat AI Inference 3.4.5 (spyre). The advisory references a critical flaw in the AIOHTTP Python framework (CVE-2026-34993) that could allow arbitrary code execution if untrusted input is loaded via the CookieJar.load() function. Exploitation requires an application to be configured to load attacker-controlled files, which is not typical in default Red Hat deployments. No fixes are currently available for these vulnerabilities in Red Hat AI Inference 3.4.5. Mitigation involves sanitizing inputs before loading untrusted data. The vendor advisory does not confirm patch availability for CVE-2026-5241 or related CVEs, and no known exploits are reported in the wild.

### Summary When dispatching a request, `HTTPEndpoint` selects the handler by lowercasing the HTTP method and looking it up as an attribute with `getattr`, without restricting the lookup to a known set of HTTP verbs. When an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. ### Details `HTTPEndpoint` uses the client-supplied method name to resolve an instance attribute, without validating it against the set of HTTP verbs the endpoint supports. A method such as `_DO_DELETE` therefore resolves an attribute like `_do_delete` and invokes it. Non-standard methods are valid [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-method) token methods, so an endpoint must not treat the method name as a trusted attribute selector. ### Impact An application is affected when all of the following hold: * It defines an `HTTPEndpoint` subclass and registers it via `Route(...)` without an explicit `methods=` argument. * The subclass defines additional methods whose names match a non-standard HTTP-method token shape and that accept a single `request` argument and return a response. This also affects frameworks built on Starlette, like FastAPI. ### Mitigation Register `HTTPEndpoint` subclasses with an explicit `methods=` argument on the `Route`, listing only the HTTP verbs the endpoint supports. The route then rejects any other method with `405 Method Not Allowed` before it reaches the endpoint, so non-standard methods cannot resolve an attribute.

### Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. ### Details `request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies. Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects: - **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v&f1=v&...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request. - **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body. The equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`. ### Impact This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop. ### Mitigation Upgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull registry.redhat.io/satellite/iop-advisor-engine-rhel9

Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage applications for faster migration to OpenShift via the user interface.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332) * receptor: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * receptor: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * receptor: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For details about this release, refer to the release notes listed in the References section.