Threats Tagged 'cve-2026-55380'

Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models (LLMs) for enterprise applications. This update provides the latest Red Hat Enterprise Linux AI 3.4.1 container disk images for use with OpenShift Virtualization. For a full list of changes in this release, see the Red Hat Enterprise Linux AI Release Notes linked in the References section.

Red Hat AI Inference Server 3.4.5 (spyre) has a security advisory issued by Red Hat Product Security covering multiple CVEs including CVE-2026-5241. The advisory lists a high severity level but does not provide specific patch or fix information. The product is Red Hat AI Inference Server, and the advisory references multiple CVEs affecting this product. No known exploits in the wild are reported at this time.

Multiple security vulnerabilities have been identified in Red Hat AI Inference Server versions 3.4.0 through 3.4.5 (rocm). These vulnerabilities are collectively addressed in Red Hat Security Advisory RHSA-2026:69469. The advisory lists numerous CVEs affecting this product version range. No specific fixes or patches are currently provided in the advisory.

Red Hat AI Inference Server 3.4.5 (cuda) has been identified with multiple security vulnerabilities, including CVE-2026-5241. The Red Hat advisory confirms the release of version 3.4.5 but does not list any fixes for these vulnerabilities. The advisory provides references and contact information but does not specify remediation steps or patches. The vulnerabilities are considered high severity based on the advisory classification.

Red Hat AI Inference Server 3.4.5 (cpu) has a security advisory issued by Red Hat Product Security addressing multiple vulnerabilities including CVE-2026-5241. The advisory lists numerous CVEs affecting the product but does not provide specific technical details or patches. No fixes are currently available as per the vendor advisory.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:44237 Security Fix(es): * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization (CVE-2026-13676) * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Enterprise Linux AI 3.3.6 update addresses multiple security vulnerabilities affecting the AI Inference Server Model Optimization Tools. The update provides enhanced container images to mitigate these issues. The vulnerabilities include a range of weaknesses such as improper input validation and memory handling errors. The update is classified as important and addresses several CVEs. No active exploits are known in the wild at this time.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * Pillow: Pillow: Native heap out-of-bounds write (CVE-2026-59197) * Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image (CVE-2026-54058) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) * automation-eda-controller: Authentication bypass in Event-Driven Ansible via forged HTTP header (CVE-2026-18141) * automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * python3.12-aiohttp: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) * python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) * python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) * python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885) * receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * automation-eda-controller: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN (CVE-2026-12383) * automation-gateway-proxy: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * python3.12-aiohttp: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * python3.12-daphne: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545) * python3.12-pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python3.12-pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * python3.12-pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python3.12-pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * python3.12-pillow: Native heap out-of-bounds write (CVE-2026-59197) * python3.12-pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59885) * python3.12-pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59886) * receptor: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) * receptor: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.