RHSA-2026:19712: Red Hat Security Advisory: RHOAI 3.3.3 - Red Hat OpenShift AI
vllm: Server Side request forgery (SSRF) in MediaConnector node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications lodash: prototype pollution in _.unset and _.omit functions qs: qs: Denial of Service via improper input validation in array parsing react-router: @remix-run/router: React Router XSS Vulnerability golang: net/url: Memory exhaustion in query parameter parsing in net/url crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate vllm: VLLM deserialization vulnerability leading to DoS and potential RCE axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization glob: glob: Command Injection Vulnerability via Malicious Filenames node-forge: node-forge ASN.1 Unbounded Recursion urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion vllm: vLLM: Remote Code Execution via malicious model configuration urllib3: urllib3 Streaming API improperly handles highly compressed data aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb ajv: ReDoS via $data reference nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability lodash: lodash: Arbitrary code execution via untrusted input in template imports urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects vLLM: vLLM: Remote code execution via invalid image processing in the multimodal endpoint. pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability vLLM: vLLM: Server-Side Request Forgery allows internal network access axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) lz4_flex: lz4_flex's decompression can leak information from uninitialized memory or reused output buffer ray: Ray Dashboard Path Traversal Leading to Local File Disclosure google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nltk: NLTK: Denial of Service via unauthenticated remote shutdown nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object axios: Axios: Remote Code Execution via Prototype Pollution escalation Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing follow-redirects: follow-redirects: Information disclosure via cross-domain redirects
CVSS v3.1: 7.5
CVSS v3.0: 7.5