CVE-2026-106451

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

• at.yawk.lz4:lz4-java Maven

  pkg:maven/at.yawk.lz4/lz4-java

  ECOSYSTEM range

  • All earlier versions (introduced 0)
  • Fixed boundary (excluded): 1.11.4

  11 explicitly listed affected versions

  1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.8.1, 1.9.0

  Additional upstream package constraints

  {
    "database": {
      "last_known_affected_version_range": "<= 1.11.3",
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mcr4-qmvw-px4g/GHSA-mcr4-qmvw-px4g.json"
    }
  }

  GitHub Advisory Database · GHSA-mcr4-qmvw-px4g · Updated 2026-10-07T20:45:06.908713391Z
• org.lz4:lz4-java Maven

  pkg:maven/org.lz4/lz4-java

  ECOSYSTEM range

  • Introduced version (included): 1.7.0
  • Last affected version (included): 1.8.1

  4 explicitly listed affected versions

  1.7.0, 1.7.1, 1.8.0, 1.8.1

  Additional upstream package constraints

  {
    "database": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mcr4-qmvw-px4g/GHSA-mcr4-qmvw-px4g.json"
    }
  }

  GitHub Advisory Database · GHSA-mcr4-qmvw-px4g · Updated 2026-10-07T20:45:06.908713391Z

Vendor product assessments

• jenkins-2-plugins.src as a component of OpenShift Developer Tools and Services · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/jenkins-2-plugins?arch=src

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services · known affected

  Vendor assessment for this product only.

  pkg:oci/jenkins-rhel8?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• ocp-tools-4/jenkins-rhel9 as a component of OpenShift Developer Tools and Services · known affected

  Vendor assessment for this product only.

  pkg:oci/jenkins-rhel9?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat build of Apache Camel 4 for Quarkus 3 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• liblz4-java.so as a component of Red Hat build of Apache Camel for Spring Boot 4 · known affected

  Vendor assessment for this product only.

  pkg:generic/liblz4-java.so

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat build of Apache Camel for Spring Boot 4 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat build of Apicurio Registry 3 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat build of Debezium 3 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat build of Quarkus · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Affected

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat Enterprise Linux 8 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java-javadoc as a component of Red Hat Enterprise Linux 8 · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/lz4-java-javadoc?rpmmod=jmc:rhel8

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• jmc as a component of Red Hat Enterprise Linux 9 · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/jmc

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• jmc.src as a component of Red Hat Enterprise Linux 9 · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/jmc?arch=src

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat Fuse 7 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • no fix planned: Out of support scope

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• maven3.9.src as a component of Red Hat Hardened Images · known affected

  Vendor assessment for this product only.

  pkg:rpm/redhat/maven3.9?arch=src

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• liblz4-java.so as a component of Red Hat JBoss Enterprise Application Platform 8 · known affected

  Vendor assessment for this product only.

  pkg:generic/liblz4-java.so

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat JBoss Enterprise Application Platform 8 · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• liblz4-java.so as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack · known affected

  Vendor assessment for this product only.

  pkg:generic/liblz4-java.so

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• lz4-java as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack · known affected

  Vendor assessment for this product only.

  pkg:maven/at.yawk.lz4/lz4-java

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-spark-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-spark-operator-rhel9@sha256:837b9d7278cac5b40b2ddd989c05e2d07566bfd6ee4454a5a6add2779fdad887?repository_url=registry.redhat.io/rhoai/odh-spark-operator-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th-torch-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th-torch-cpu-py312-rhel9@sha256:d265d1398bceb2d971d725e27e81c8def1213b2f0dc265a37707b2f4270317ca?repository_url=registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th-torch-cuda-py312-rhel9@sha256:efd7b3607b699092c68359d20ef0d0043114191a097637667c0d2cf78fbea702?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th06-cpu-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th06-cpu-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th06-cpu-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th06-cpu-torch291-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch291-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th06-cuda130-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th06-cuda130-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th06-cuda130-torch291-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch291-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00
• rhoai/odh-th06-rocm64-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

  Vendor assessment for this product only.

  pkg:oci/odh-th06-rocm64-torch291-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-rocm64-torch291-py312-rhel9

  • workaround: Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp. 1. Create a directory accessible only by the service account running the Java process: ```bash mkdir -p /var/run/app-private-tmp chmod 700 /var/run/app-private-tmp ``` 2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment: ``` -Djava.io.tmpdir=/var/run/app-private-tmp ``` Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
  • none available: Fix deferred

  Red Hat · CVE-2026-106451 · Updated 2026-10-13T11:36:32+00:00