RHSA-2026:90432HighCVSS 8.8

Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.4.6 security update

Published
October 26, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (11)

CVE-2026-97687 →CVE-2026-97688 →CVE-2026-102598 →CVE-2026-104851 →CVE-2026-104874 →CVE-2026-15679 →CVE-2026-37237 →CVE-2026-55514 →CVE-2026-97689 →CVE-2026-100650 →CVE-2026-102273 →

📋 Description

CVE-2026-15679 — timm: Hugging Face PyTorch Image Models: Remote Code Execution via Deserialization of Untrusted Data CVE-2026-37237 — vllm: vLLM: Denial of Service via memory exhaustion from oversized media files CVE-2026-55514 — vllm: vLLM: Denial of Service via crafted prompt in /v1/completions request CVE-2026-97687 — urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override CVE-2026-97688 — urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding CVE-2026-97689 — urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-100650 — vllm: vLLM: Denial of Service via unbounded media ingestion CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-102598 — werkzeug: werkzeug: Denial of Service via safe_join() Windows special device paths CVE-2026-104851 — fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem CVE-2026-104874 — multidict: multidict: Denial of Service via memory leak in items-view operations

🎯 Affected products2

  • Red Hat Enterprise Linux AI 3.4
  • registry.redhat.io/rhelai3/disk-image-cuda-rhel9@sha256:104c02083a70d41a1063e3cc4aff5acc43dad9a1ed2b34cd15b88d254120d337_amd64 as a component of Red Hat Enterprise Linux AI 3.4

✅ Remediation

The container disk images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command, for use with OpenShift Virtualization. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restricting the domains that vLLM is allowed to fetch media from reduces exposure to this issue. Set the `--allowed-media-domains` option to an explicit allowlist of the domains you expect media to come from (for example `--allowed-media-domains upload.wikimedia.org github.com`), so that clients cannot direct the server to download arbitrarily large files from arbitrary hosts. Also consider setting `VLLM_MEDIA_URL_ALLOW_REDIRECTS=0` so that HTTP redirects cannot be followed to bypass the domain restrictions, as recommended in the upstream vLLM security documentation. Note that this restricts which hosts may be fetched but does not by itself impose a limit on the size of responses served by allowlisted domains. Workaround: Limit network exposure to the vLLM inference service and block outbound network connections from the serving host or container to prevent fetching untrusted external media: 1. Restrict inbound access using firewall rules so only trusted client networks or API gateways can reach the inference port (e.g., port 8000): # firewall-cmd --zone=public --remove-port=8000/tcp --permanent # firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> --permanent # firewall-cmd --reload 2. In OpenShift AI environments, apply a Kubernetes NetworkPolicy to the pod namespace to restrict ingress traffic strictly to authorized proxy pods, and apply an egress rule that blocks outbound internet access, preventing the service from downloading arbitrary remote media URLs. 3. Enforce maximum request body size limits on upstream reverse proxies or ingress controllers to drop oversized inline base64 payloads before forwarding requests to the inference backend. Caveats: Restricting egress traffic will prevent valid remote media references from being processed if external multi-modal inputs are expected. Modifying firewall rules or reloading network services may briefly interrupt active connections.

🔗 References (16)