Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (ROCm)

Weakness classes (CWE)

• CWE-367Base

  Time-of-check Time-of-use (TOCTOU) Race Condition

  The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

  cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Modified2026-09-09 13:20 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
   • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/4xxx/CVE-2026-4878.json">CVE-2026-4878</a>
2. CVE Modified2026-09-08 16:18 UTC· secalert@redhat.com
   • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/4xxx/CVE-2026-4878.json">CVE-2026-4878</a>
3. CVE Modified2026-09-08 14:17 UTC· secalert@redhat.com
   • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/4xxx/CVE-2026-4878.json">CVE-2026-4878</a>
4. CVE Modified2026-09-07 21:17 UTC· secalert@redhat.com
   • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/4xxx/CVE-2026-4878.json">CVE-2026-4878</a>
5. CVE Modified2026-09-07 13:20 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
   • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/4xxx/CVE-2026-4878.json">CVE-2026-4878</a>

Affected operating systems

• linux

  debian / debian_linux11.0

• linux

  redhat / enterprise_linux10.0

• linux

  redhat / enterprise_linux6.0

• linux

  redhat / enterprise_linux7.0

• linux

  redhat / enterprise_linux8.0

• linux

  redhat / enterprise_linux9.0

• linux

  redhat / enterprise_linux_ai3.0

• linux

  ubuntu / jqbionic

• linux

  ubuntu / jqfocal

• linux

  ubuntu / popplerjammy

• linux

  ubuntu / popplernoble

• linux

  ubuntu / popplerquesting

• linux

  ubuntu / popplerresolute

• other

  siemens / sinec_os

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

• bitnami

  python-min3.11.0

• bitnami

  python-min3.12.0

• bitnami

  python-min3.13.0

• bitnami

  python-min3.14.0

• cryptography.io

  cryptography45.0.0 – 46.0.7

• encode

  starlette0.8.3 – 1.0.1

• encode

  starlette1.1.0

• IBM

  QRadar SIEM<7.5.0 UP15 IF06

• jqlang

  jq2026-04-12

• libcap_project

  libcap

• libsndfile_project

  libsndfile

• libtiff

  libtiff

• openbsd

  openssh10.3

• openexr

  openexr3.1.0 – 3.2.7

• openexr

  openexr3.3.0 – 3.3.9

• openexr

  openexr3.4.0 – 3.4.9

• pyasn1

  pyasn10.6.2

• pyjwt_project

  pyjwt2.13.0

• pypi

  vllm0.0.1

• pypi

  vllm0.1.0

• pypi

  vllm0.10.0

• pypi

  vllm0.10.1

• pypi

  vllm0.10.1.1

• pypi

  vllm0.10.2

References & sources

• https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
  x_refsource_CONFIRM
• https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615
  x_refsource_MISC
• https://github.com/vim/vim/releases/tag/v9.2.0276
  x_refsource_MISC
• http://www.openwall.com/lists/oss-security/2026/04/01/1
• https://access.redhat.com/security/cve/CVE-2026-34982
  vdb-entryx_refsource_REDHAT
• https://bugzilla.redhat.com/show_bug.cgi?id=2455400
  issue-trackingx_refsource_REDHAT
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34982.json
  x_sadp-csaf-vex
• https://access.redhat.com/errata/RHSA-2026:30900
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:11389
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:19073
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:11509
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:33453
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:34477
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:34476
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:28133
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:28049
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:28050
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:11510
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:19224
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:36004
  vendor-advisoryx_refsource_REDHAT

Linked CVEs

• CVE-2026-6100

  A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`.

  criticalCVSSv3 8.1
• CVE-2026-48818

  A flaw was found in Starlette, a lightweight ASGI framework.

  highCVSSv3 7.5
• CVE-2026-48746

  A flaw was found in vLLM, an inference and serving engine for large language models (LLMs).

  criticalCVSSv3 9.1
• CVE-2026-48710Actively exploited

  A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework.

  criticalCVSSv3 6.5
• CVE-2026-48526

  A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation.

  highCVSSv3 7.4
• CVE-2026-4786

  A flaw was found in the Python webbrowser.open() API.

  highCVSSv3 7.1
• CVE-2026-4775

  A flaw was found in the libtiff library.

  highCVSSv3 7.8
• CVE-2026-44432

  urllib3 is an HTTP client library for Python.

  highCVSSv3 7.5
• CVE-2026-44431

  A flaw was found in urllib3, an HTTP client library for Python.

  high
• CVE-2026-40164

  A flaw was found in jq, a command-line JSON processor.

  highCVSSv3 7.5
• CVE-2026-39979

  A flaw was found in jq, a command line JSON processor, specifically in the libjq API.

  mediumCVSSv3 6.5
• CVE-2026-39892

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

  criticalCVSSv3 9.8
• CVE-2026-37555

  A flaw was found in the libsndfile library.

  highCVSSv3 7.5
• CVE-2026-35535

  A flaw was found in Sudo.

  highCVSSv3 7.8
• CVE-2026-35385

  A flaw was found in OpenSSH.

  highCVSSv3 8.1
• CVE-2026-34982

  A flaw was found in Vim.

  highCVSSv3 8.2
• CVE-2026-34588

  OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture in…

  highCVSSv3 7.8
• CVE-2026-24779

  A flaw was found in vLLM, an inference and serving engine for large language models (LLMs).

  highCVSSv3 7.1
• CVE-2026-23490

  A flaw was found in pyasn1, a generic ASN.1 library for Python.

  highCVSSv3 7.5
• CVE-2026-22807

  A flaw was found in vLLM, an inference and serving engine for large language models (LLMs).

  highCVSSv3 8.8
• CVE-2026-22778

  A flaw was found in vLLM, an inference and serving engine for large language models (LLMs).

  criticalCVSSv3 9.8
• CVE-2026-10118

  A flaw was found in Poppler's Splash backend.

  highCVSSv3 7.8