{"schema":"vulnpedia.research/1","cve":"CVE-2026-69147","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-16T18:37:14.118Z","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"nvd","sourceId":"CVE-2026-69147","modified":"2026-10-07T14:16:57.827","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j"}]},{"url":"https://github.com/vllm-project/vllm/pull/47259","tags":["x_refsource_MISC","Issue Tracking","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","url":"https://github.com/vllm-project/vllm/pull/47259"},{"source":"nvd","sourceId":"CVE-2026-69147","modified":"2026-10-07T14:16:57.827","url":"https://github.com/vllm-project/vllm/pull/47259"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://github.com/vllm-project/vllm/pull/47259"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/vllm-project/vllm/pull/47259"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://github.com/vllm-project/vllm/pull/47259"},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://github.com/vllm-project/vllm/pull/47259"}]},{"url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda"},{"source":"nvd","sourceId":"CVE-2026-69147","modified":"2026-10-07T14:16:57.827","url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda"},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://github.com/vllm-project/vllm/commit/283893c72292ede38d277e3cd2b9b64c3e4f1dda"}]},{"url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-09-16T17:49:20.427Z","url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d"},{"source":"nvd","sourceId":"CVE-2026-69147","modified":"2026-10-07T14:16:57.827","url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d"},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://github.com/vllm-project/vllm/commit/ba22152096b2484faa3579624a253d54804d876d"}]},{"url":"https://osv.dev/vulnerability/GHSA-8pw2-6jv3-mj5j","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","origins":[{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://osv.dev/vulnerability/GHSA-8pw2-6jv3-mj5j"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://osv.dev/vulnerability/GHSA-8pw2-6jv3-mj5j"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69147","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","origins":[{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69147"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69147"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69147"},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69147"}]},{"url":"https://github.com/vllm-project/vllm","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","origins":[{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://github.com/vllm-project/vllm"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/vllm-project/vllm"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://github.com/vllm-project/vllm"}]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.25.0","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","origins":[{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://github.com/vllm-project/vllm/releases/tag/v0.25.0"},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/vllm-project/vllm/releases/tag/v0.25.0"},{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://github.com/vllm-project/vllm/releases/tag/v0.25.0"}]},{"url":"https://osv.dev/vulnerability/PYSEC-2026-4178","tags":["ADVISORY"],"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://osv.dev/vulnerability/PYSEC-2026-4178"},{"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","url":"https://osv.dev/vulnerability/PYSEC-2026-4178"}]},{"url":"https://pypi.org/project/vllm","tags":["PACKAGE"],"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://pypi.org/project/vllm"},{"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","url":"https://pypi.org/project/vllm"}]},{"url":"https://github.com/advisories/GHSA-8pw2-6jv3-mj5j","tags":["ADVISORY"],"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://github.com/advisories/GHSA-8pw2-6jv3-mj5j"},{"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","url":"https://github.com/advisories/GHSA-8pw2-6jv3-mj5j"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69147","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-69147"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535581","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535581"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69147","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-69147"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82415","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82415"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82368","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82368"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82061","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82061"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82059","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82059"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82371","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82371"}]},{"source":"euvd","sourceId":"EUVD-2026-80935","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80935","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-80935","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80935"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","url":"https://osv.dev/vulnerability/GHSA-8pw2-6jv3-mj5j","ecosystem":"PyPI","name":"vllm","purl":"pkg:pypi/vllm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.10.0","0.10.1","0.10.1.1","0.10.2","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.17.0","0.17.1","0.18.0","0.18.1","0.19.0","0.19.1","0.2.0","0.2.1","0.2.1.post1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.20.0","0.20.1","0.20.2","0.21.0","0.22.0","0.22.1","0.23.0","0.24.0","0.25.0","0.25.1","0.26.0","0.27.0","0.27.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.0.post1","0.4.1","0.4.2","0.4.3","0.5.0","0.5.0.post1","0.5.1","0.5.2","0.5.3","0.5.3.post1","0.5.4","0.5.5","0.6.0","0.6.1","0.6.1.post1","0.6.1.post2","0.6.2","0.6.3","0.6.3.post1","0.6.4","0.6.4.post1","0.6.5","0.6.6","0.6.6.post1","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.5.post1","0.9.0","0.9.0.1","0.9.1","0.9.2"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8pw2-6jv3-mj5j/GHSA-8pw2-6jv3-mj5j.json"},"modified":"2026-10-01T17:55:52.391144765Z","origins":[{"source":"ghsa","sourceId":"GHSA-8pw2-6jv3-mj5j","modified":"2026-10-01T17:55:52.391144765Z","url":"https://osv.dev/vulnerability/GHSA-8pw2-6jv3-mj5j"}]},{"source":"pysec","sourceId":"PYSEC-2026-4178","url":"https://osv.dev/vulnerability/PYSEC-2026-4178","ecosystem":"PyPI","name":"vllm","purl":"pkg:pypi/vllm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.10.0","0.10.1","0.10.1.1","0.10.2","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.17.0","0.17.1","0.18.0","0.18.1","0.19.0","0.19.1","0.2.0","0.2.1","0.2.1.post1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.20.0","0.20.1","0.20.2","0.21.0","0.22.0","0.22.1","0.23.0","0.24.0","0.25.0","0.25.1","0.26.0","0.27.0","0.27.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.0.post1","0.4.1","0.4.2","0.4.3","0.5.0","0.5.0.post1","0.5.1","0.5.2","0.5.3","0.5.3.post1","0.5.4","0.5.5","0.6.0","0.6.1","0.6.1.post1","0.6.1.post2","0.6.2","0.6.3","0.6.3.post1","0.6.4","0.6.4.post1","0.6.5","0.6.6","0.6.6.post1","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.5.post1","0.9.0","0.9.0.1","0.9.1","0.9.2"],"databaseSpecific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-4178.yaml"},"modified":"2026-10-01T17:45:09.325879460Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4178","modified":"2026-10-01T17:45:09.325879460Z","url":"https://osv.dev/vulnerability/PYSEC-2026-4178"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:bcd8563d0888d97cb346557d77f823ba8480daa84695e2bfb9e2e1827117fb39_amd64","product":"registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:bcd8563d0888d97cb346557d77f823ba8480daa84695e2bfb9e2e1827117fb39_amd64 as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82415","url":"https://access.redhat.com/errata/RHSA-2026:82415"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-cpu-rhel9@sha256%3Abcd8563d0888d97cb346557d77f823ba8480daa84695e2bfb9e2e1827117fb39?arch=amd64&repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9&tag=1791473614","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:57c9bb9052ad8ab90348b91fa7d59c6e5f02311cf812e89345cdbfd6da286280_arm64","product":"registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:57c9bb9052ad8ab90348b91fa7d59c6e5f02311cf812e89345cdbfd6da286280_arm64 as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82368","url":"https://access.redhat.com/errata/RHSA-2026:82368"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-cuda-rhel9@sha256%3A57c9bb9052ad8ab90348b91fa7d59c6e5f02311cf812e89345cdbfd6da286280?arch=arm64&repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9&tag=1791473631","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:8d8180e8c11b6ab6344ad42ef80ed03e35815d2fcd835b3b4ec931c64b934461_amd64","product":"registry.redhat.io/rhaii/vllm-cuda-rhel9@sha256:8d8180e8c11b6ab6344ad42ef80ed03e35815d2fcd835b3b4ec931c64b934461_amd64 as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82368","url":"https://access.redhat.com/errata/RHSA-2026:82368"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-cuda-rhel9@sha256%3A8d8180e8c11b6ab6344ad42ef80ed03e35815d2fcd835b3b4ec931c64b934461?arch=amd64&repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9&tag=1791473631","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-gaudi-rhel9@sha256:ba46859d4cb085c111a27bc665c15e5f826320e86c03b940f7a28f40df79ad22_amd64","product":"registry.redhat.io/rhaii/vllm-gaudi-rhel9@sha256:ba46859d4cb085c111a27bc665c15e5f826320e86c03b940f7a28f40df79ad22_amd64 as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82061","url":"https://access.redhat.com/errata/RHSA-2026:82061"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-gaudi-rhel9@sha256%3Aba46859d4cb085c111a27bc665c15e5f826320e86c03b940f7a28f40df79ad22?arch=amd64&repository_url=registry.redhat.io/rhaii/vllm-gaudi-rhel9&tag=1791427182","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:fad3819d9130fa3e9cfa7ab2f0d1b420140d93cfe2242f78dc289146ef985f4e_amd64","product":"registry.redhat.io/rhaii/vllm-rocm-rhel9@sha256:fad3819d9130fa3e9cfa7ab2f0d1b420140d93cfe2242f78dc289146ef985f4e_amd64 as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82059","url":"https://access.redhat.com/errata/RHSA-2026:82059"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-rocm-rhel9@sha256%3Afad3819d9130fa3e9cfa7ab2f0d1b420140d93cfe2242f78dc289146ef985f4e?arch=amd64&repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9&tag=1791425869","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:06d05633adc879bab2f1e3e7b3b394873304f4dd520e0f2a0b84da344e9bda30_amd64","product":"registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:06d05633adc879bab2f1e3e7b3b394873304f4dd520e0f2a0b84da344e9bda30_amd64 as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82371","url":"https://access.redhat.com/errata/RHSA-2026:82371"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-spyre-rhel9@sha256%3A06d05633adc879bab2f1e3e7b3b394873304f4dd520e0f2a0b84da344e9bda30?arch=amd64&repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9&tag=1791818357","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:0e3d5aab4d8a75370eca1e71854fa31b9cd7e219b6a5e990d9b559b17045cb9d_s390x","product":"registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:0e3d5aab4d8a75370eca1e71854fa31b9cd7e219b6a5e990d9b559b17045cb9d_s390x as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82371","url":"https://access.redhat.com/errata/RHSA-2026:82371"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-spyre-rhel9@sha256%3A0e3d5aab4d8a75370eca1e71854fa31b9cd7e219b6a5e990d9b559b17045cb9d?arch=s390x&repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9&tag=1791818357","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"Red Hat AI Inference Server 3.5:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:a692177742a9f381b5394f60c9fbb3856d59e1a6e86140ee980c5fd184fff137_ppc64le","product":"registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:a692177742a9f381b5394f60c9fbb3856d59e1a6e86140ee980c5fd184fff137_ppc64le as a component of Red Hat AI Inference Server 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:82371","url":"https://access.redhat.com/errata/RHSA-2026:82371"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."}],"purl":"pkg:oci/vllm-spyre-rhel9@sha256%3Aa692177742a9f381b5394f60c9fbb3856d59e1a6e86140ee980c5fd184fff137?arch=ppc64le&repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9&tag=1791818357","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaii/vllm-neuron-rhel9","product":"rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaii/vllm-tpu-rhel9","product":"rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-tpu-rhel9?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-cpu-rhel9","product":"rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-cpu-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-cuda-rhel9","product":"rhaiis/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-cuda-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-neuron-rhel9","product":"rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-rocm-rhel9","product":"rhaiis/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-rocm-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-spyre-rhel9","product":"rhaiis/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-spyre-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-tpu-rhel9","product":"rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/vllm-tpu-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-tpu-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-aws-cuda-rhel9","product":"rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-cuda-rhel9","product":"rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-rocm-rhel9","product":"rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9","product":"rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gaudi-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gcp-cuda-rhel9","product":"rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-kserve-agent-rhel9","product":"rhoai/odh-kserve-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-kserve-agent-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-kserve-controller-rhel9","product":"rhoai/odh-kserve-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-kserve-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-controller-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-kserve-router-rhel9","product":"rhoai/odh-kserve-router-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-kserve-router-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-kserve-storage-initializer-rhel9","product":"rhoai/odh-kserve-storage-initializer-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-kserve-storage-initializer-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-llm-d-kv-cache-rhel9","product":"rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-llm-d-kv-cache-rhel9?repository_url=registry.redhat.io/rhoai/odh-llm-d-kv-cache-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th-torch-cuda-py312-rhel9","product":"rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-th-torch-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]},{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-gaudi-rhel9","product":"rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream vLLM project addressed this flaw in version 0.28.0, while fixes for Red Hat AI Inference Server and Red Hat OpenShift AI are currently deferred. Exposure can be reduced by not installing the PyNvVideoCodec decoder in vLLM serving images, since exploitation requires that backend to be present."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-69147","modified":"2026-10-16T11:53:51+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69147.json"}]}],"vendorCoverage":{"total":30,"shown":30,"omitted":0,"source":"redhat"}}