Vulnerabilities of Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion…	7.5 High	May 7, 2026
CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322	7.5 High	May 7, 2026
CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it…	7.5 High	May 7, 2026
CVE-2026-6322	fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them…	7.5 High	May 5, 2026
CVE-2026-43868	Memory Allocation with Excessive Size Value vulnerability in Apache Thrift	Not rated	May 5, 2026
CVE-2026-41607	Out-of-bounds Read vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41606	Uncontrolled Recursion vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41605	Integer Overflow or Wraparound vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41604	Out-of-bounds Read vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41603	Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-42039	Axios is a promise based HTTP client for the browser and Node.js	6.9 Medium	Apr 24, 2026
CVE-2026-42041	Axios is a promise based HTTP client for the browser and Node.js	4.8 Medium	Apr 24, 2026
CVE-2026-42043	Axios is a promise based HTTP client for the browser and Node.js	7.2 High	Apr 24, 2026
CVE-2026-42044	Axios is a promise based HTTP client for the browser and Node.js	6.5 Medium	Apr 24, 2026
CVE-2026-42033	Axios is a promise based HTTP client for the browser and Node.js	7.4 High	Apr 24, 2026
CVE-2026-6859	A flaw was found in InstructLab	8.8 High	Apr 22, 2026
CVE-2026-6855	A flaw was found in InstructLab	7.1 High	Apr 22, 2026
CVE-2026-40895	follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…	6.9 Medium	Apr 21, 2026
CVE-2026-6654	Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate	5.1 Medium	Apr 20, 2026
CVE-2026-41242	protobufjs compiles protobuf definitions into JavaScript (JS) functions	9.4 Critical	Apr 18, 2026
CVE-2026-6385	A flaw was found in FFmpeg	6.5 Medium	Apr 15, 2026
CVE-2026-33806	Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed…	7.5 High	Apr 15, 2026
CVE-2026-6100	Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a…	9.1 Critical	Apr 13, 2026
CVE-2019-25695	R 3.4.4 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by injecting…	8.6 High	Apr 12, 2026
CVE-2026-40175	Axios is a promise based HTTP client for the browser and Node.js	4.8 Medium	Apr 10, 2026

Other Red Hat products