{"resourceId":"redhat-ai-inference-353-vllm-60-cve-batch-20261103","versions":[{"version":"external-55540299ebb29d2751a064d9c5f661f58e1e6fc3f19e1ceb8e6e18cf0c36cea1","resource":{"id":"redhat-ai-inference-353-vllm-60-cve-batch-20261103","title":"Red Hat AI Inference 3.5.3 ships Critical fixes for 60 CVEs, including vLLM code-execution and SSRF flaws, while 'fast' images remain Affected","organization":"Red Hat Product Security","sector":"AI inference software used by public and private sectors (Red Hat AI Inference Server / vLLM)","geography":"Global product advisory; applies to any US SLED deployment of Red Hat AI Inference 3.5","publishedAt":"RHSA-2026:94702, 94709, 94717, 94721 and 94738 issued Nov. 3, 2026; underlying CVEs public Aug.-Oct. 2026","publicationDate":"2026-11-03","eventDate":"2026-11-03","sourceName":"Red Hat Customer Portal (errata)","sourceLabel":"RHSA-2026:94738 - Red Hat AI Inference 3.5.3 (CUDA) (Critical)","sourceUrl":"https://access.redhat.com/errata/RHSA-2026:94738","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security","operating-model"],"finding":"Vendor record: on Nov. 3, 2026 Red Hat issued five Critical advisories for Red Hat AI Inference 3.5.3 covering CUDA, CPU, ROCm, Spyre and Gaudi (Tech Preview) builds, each listing the same 60 CVEs. The vLLM fixes include remote code execution through a crafted code_revision when trust-remote-code is enabled (CVE-2026-114053), SSRF through the X-Request-Id header (CVE-2026-116176), unsafe image-format handling (CVE-2026-115915) and denial-of-service flaws. Red Hat's security data, checked the evening of Nov. 4, still lists the rhaii-fast vLLM images as Affected, and marks some older rhaiis images 'Will not fix' for two DoS flaws. An independent advisory entry confirms the ReDoS gap stayed open in one backend after an earlier fix. Interpretation: inference endpoints exposed to campus or agency users should move to 3.5.3 now.","sledRelevance":"State agencies, universities and research computing centers that self-host open models on Red Hat AI Inference or vLLM behind chat assistants, document tools or student-facing services face network-reachable flaws, some unauthenticated. Self-hosting is often chosen for data residency, so patch ownership sits with the agency or campus, not a SaaS provider.","evidence":"Read RHSA-2026:94738 and RHSA-2026:94702 in full and checked titles and CVE counts for 94709, 94717 and 94721; Red Hat security data JSON for CVE-2026-114053, CVE-2026-116176, CVE-2026-73556 and CVE-2026-93592; GitLab advisory entry for CVE-2026-73556.","architectureImplications":"Fixes reach production only when serving deployments are redeployed on 3.5.3 images. Sites on the 'fast' channel or older rhaiis images need a separate plan, since those are still Affected or marked Will not fix. Trust-remote-code and multimodal endpoints widen exposure.","governanceImplications":"Five Critical advisories on one day give an auditable patch trigger. Exceptions for still-Affected channels should be documented and time-boxed.","securityPrivacyImplications":"Red Hat describes possible code execution, SSRF-driven information disclosure and denial of service. In public-sector inference services, that could expose prompts, retrieved documents or internal network endpoints. Red Hat notes trust-remote-code is disabled by default, which lowers but does not remove risk.","caveats":"Vendor advisories are terse; no exploitation evidence found (no vLLM entries in CISA KEV as checked Nov. 4); package states observed once; severity differs between Red Hat and third-party scoring.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: a patch-hygiene conversation, not a new purchase. For state and campus teams self-hosting models on Red Hat AI Inference, five Critical advisories on Nov. 3 are a reason to review how AI runtimes are patched and who owns them. Offer a bounded health check. Interpretation only: the advisories do not show exploitation or any customer incident, so avoid fear-based pitches or promises of reduced risk.","engineering":"Engineering framing: confirm channel and configuration. Identify whether each serving deployment uses the 3.5 stable images, the rhaii-fast channel or older rhaiis images; only 3.5.3 is fixed. Check whether trust-remote-code, multimodal input or P2P KV offloading is enabled, and whether endpoints are reachable without authentication. Applicability is limited to sites running Red Hat AI Inference or vLLM.","delivery":"Delivery framing: redeploy, verify and document exceptions. The AI platform team should roll serving workloads to 3.5.3 digests, run a smoke test on accuracy and latency, and record a time-boxed exception for any 'fast' or legacy images still Affected. Proposed acceptance: all production endpoints on fixed digests within the agency's critical-patch window. Interpretation, not an observed result."},"roleDetails":{"sales":{"customerProblem":"Self-hosted AI inference endpoints carry network-reachable vLLM flaws that need prompt, owned patching.","stakeholders":["Agency or campus CISO","AI platform owner","Research computing director"],"discoveryQuestions":["Which Red Hat AI Inference channel and version do you run?","Are any inference endpoints reachable without authentication?","Who owns patching for model-serving images?"],"valueHypothesis":"A short runtime review can reduce exposure windows on self-hosted AI; benefit is unquantified.","potentialEngagement":"Bounded AI inference patch and configuration health check for one environment.","unsupportedClaims":["Active exploitation of these vLLM flaws","Any SLED customer incident","Guaranteed risk reduction or savings"]},"engineering":{"fit":"Sites serving models with Red Hat AI Inference 3.5 on CPU, CUDA, ROCm, Spyre or Gaudi.","architectureIntegration":"Replace serving images with 3.5.3 digests in OpenShift or RHEL deployments; review gateway authentication in front of vLLM endpoints.","prerequisites":["Image inventory by channel","Digest-pinned manifests","Test environment for model regression"],"constraints":["rhaii-fast images still Affected","Some older rhaiis images marked Will not fix","Gaudi build is Tech Preview"],"security":"Disable trust-remote-code unless required; restrict media input types; authenticate inference endpoints.","proofOfValue":["Verify deployed digests match RHSA-2026:94738 or companion builds","Confirm trust-remote-code disabled","Re-check package_state for fast-channel fixes"]},"delivery":{"work":"Roll inference workloads to 3.5.3, validate, and document exceptions for unfixed channels.","dependencies":["Change window","Model regression tests","Vendor fixes for fast channel"],"ownership":"AI platform team with security operations oversight.","skillsAdoption":"Train platform staff on Red Hat AI image channels and security data API checks.","governanceCheckpoints":["Critical-patch window review","Exception approval for Affected channels","Post-deployment verification"],"acceptanceCriteria":["Proposed: all production endpoints on fixed digests","Proposed: zero unauthenticated inference endpoints","Proposed: exceptions closed within 30 days"],"risks":["Model behavior regression after upgrade","Overlooked fast-channel deployments","Assuming default config is in use"]}},"retrievedAt":"2026-11-05T04:04:04Z","enrichedAt":"2026-11-05T04:07:11Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires staff who can track AI runtime channels and redeploy model servers. Smaller campus or county teams may need partner support.","procurementImplications":"Contracts for self-hosted AI should spell out patch SLAs per image channel and how 'Will not fix' decisions are communicated.","operatingModelImplications":"Moves AI runtime patching into routine vulnerability management with named owners per image channel.","sourceVerification":{"openedUrl":"https://access.redhat.com/errata/RHSA-2026:94738","referenceExcerpt":"Red Hat AI Inference 3.5.3 (CUDA) is now available.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}