Red Hat Ai Inference Server 3.2 vulnerabilities

14 CVEs affecting Red Hat Ai Inference Server 3.2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15588, published 2026-07-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-33846, published 2026-05-04. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and…
CVE-2026-28356, published 2026-03-12. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous…
CVE-2025-9900, published 2025-09-23. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image…
CVE-2026-56211, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control…
CVE-2026-6100, published 2026-04-13. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is…
CVE-2026-4111, published 2026-03-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is…
CVE-2025-14831, published 2026-02-09. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates…
CVE-2026-56209, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an…
CVE-2026-40164, published 2026-04-14. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table…
CVE-2026-56210, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows…

Latest

CVE-2026-15588, published 2026-07-20. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data…
CVE-2026-16118, published 2026-07-17. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME…
CVE-2026-56208, published 2026-06-19. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer…
CVE-2026-4786, published 2026-04-13. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the…