| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp: Multiple instances of excessive or unbounded memory/CPU useCVE-2026-123817 · GHSA-2G87-PP6C-29X5 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PYSEC-2026-4361CVE-2026-114052 · GHSA-823J-M4CJ-HMJF |
vllmRed Hat AI Inference Server/rhaii/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PYSEC-2026-4362CVE-2026-114054 · GHSA-RH6F-3X46-J33Q |
vllmRed Hat AI Inference Server/rhaii/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargsCVE-2026-115918 · GHSA-X567-49G5-P4CFVersion ranges need review. |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)CVE-2026-115916 · GHSA-Q97C-P368-75C4Version ranges need review. |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread poolCVE-2026-115911 · GHSA-542M-9234-8GVFVersion ranges need review. |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PYSEC-2026-4350CVE-2026-116173 · GHSA-6PGW-F3PV-4H8Q |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PYSEC-2026-4353CVE-2026-116178 · GHSA-34QW-Q2H2-JP3M |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledCVE-2026-115912 · GHSA-6757-HGGM-HP2WVersion ranges need review. |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP serverCVE-2026-115917 · GHSA-VVPG-RRWW-WPMHVersion ranges need review. |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lockCVE-2026-112941 · GHSA-WFHQ-Q4J2-C37M |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| vLLM DeepSeek-OCR image processing vulnerable to denial of serviceCVE-2026-115914 · GHSA-GQ5Q-89C7-VHVX |
vllmRed Hat AI Inference Server/rhaii-fast/vllm-cpu-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdCVE-2026-112908 · GHSA-6627-M3XW-93MP |
filelockExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionCVE-2026-112911 · GHSA-9C4X-GM8V-WGC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerCVE-2026-112912 · GHSA-9J6Q-WVJ5-JGJG |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
