Red Hat OpenShift AI (RHOAI)/rhai/base-image-tpu-rhel9

Red Hat · Package

15 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
pip Vulnerable to Inclusion of Functionality from Untrusted Control SphereCVE-2026-6357 · GHSA-JP4C-XJXW-MGF9Version ranges need review.	pip Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9	PyPIRed Hat	Medium	Fix reported	2026-09-10
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP filesCVE-2026-3219 · GHSA-58QW-9MGM-455VVersion ranges need review.	pip Lightspeed Core/lightspeed-core/lightspeed-stack-rhel9	PyPIRed Hat	Medium	Fix reported	2026-09-10
python: Python/Expat: Denial of Service via crafted XML documentCVE-2026-7210	Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9	Red Hat	Medium	No fix reported	Not recorded
python: Python unicodedata: Denial of Service due to excessive CPU consumptionCVE-2026-3276	Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9	Red Hat	Medium	No fix reported	Not recorded
python: Python tarfile module: Denial of Service via improper EOF handling in streaming modeCVE-2026-11972	Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9	Red Hat	Medium	No fix reported	Not recorded
llvm: llvm: Denial of Service via stack-based buffer overflow in StringMap::insertCVE-2026-13573	Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9	Red Hat	Low	No fix reported	Not recorded
python: Python Tarfile: Unexpected file ownership when extracting hardlinksCVE-2026-4360	Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9	Red Hat	Medium	No fix reported	Not recorded
hdf5: HDF5: Out-of-bounds read due to corrupted file can lead to denial of serviceCVE-2026-26197	Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
HDF5: HDF5: Denial of Service via buffer underflow in H5Iget_nameCVE-2026-26199	Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
thrift: Apache Thrift C++ bindings: Information disclosure due to buffer over-read vulnerabilityCVE-2026-55970	Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-payload-rhel9 Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9	Red Hat	Medium	No fix reported	Not recorded
hdf5: HDF5: Denial of Service via crafted file requiring user interactionCVE-2026-17572	Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
hdf5: HDF5 library: Denial of Service via crafted HDF5 file processingCVE-2026-17573	Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
HDF5: HDF5: Denial of Service via crafted HDF5 file processingCVE-2026-17574	Red Hat AI Inference Server/rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server/rhaii/vllm-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
uv: uv: Arbitrary file write via crafted symlinks in source distribution extractionCVE-2025-71437	Lightspeed Core/lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core/lightspeed-core/rag-tool-cpu-rhel9	Red Hat	Medium	No fix reported	Not recorded
uv: uv: Arbitrary code execution via path traversal in entry point namesCVE-2026-114109	Lightspeed Core/lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core/lightspeed-core/rag-tool-cpu-rhel9	Red Hat	High	No fix reported	Not recorded