Vulnpedia
← Search CVEs

CVE-2026-91990

HIGH 8.7

Published 2026-09-15 · Last modified 2026-09-15

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 36th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.7CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Tornadoweb

Products Tornado

Weakness (CWE)

  • CWE-770: Allocation of Resources Without Limits or Throttling

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • tornado PyPI

    pkg:pypi/tornado

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 6.5.8
    83 explicitly listed affected versions

    0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1, 2.0, 2.1, 2.1.1, 2.2, 2.2.1, 2.3, 2.4, 2.4.1, 3.0, 3.0.1, 3.0.2, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 4.0, 4.0.1, 4.0.2, 4.1, 4.1b2, 4.2, 4.2.1, 4.2b1, 4.3, 4.3b1, 4.3b2, 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4b1, 4.5, 4.5.1, 4.5.2, 4.5.3, 4.5b1, 4.5b2, 5.0, 5.0.1, 5.0.2, 5.0a1, 5.0b1, 5.1, 5.1.1, 5.1b1, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0a1, 6.0b1, 6.1, 6.1b1, 6.1b2, 6.2, 6.2b1, 6.2b2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3b1, 6.4, 6.4.1, 6.4.2, 6.4b1, 6.5, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5b1

    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 6.5.7",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8423-8fgw-73vq/GHSA-8423-8fgw-73vq.json"
  }
}
    GitHub Advisory Database · GHSA-8423-8fgw-73vq · Updated 2026-09-16T03:56:01.992806508Z

Vendor product assessments

Showing 32 of 1047 vendor product statements; 1015 omitted. Read the full vendor advisory.

  • python-tornado-0:6.5.8-0.el10_0.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0.1?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • python3-tornado-debuginfo-0:6.5.8-0.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0.1?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • python3-tornado-0:6.5.8-0.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.1?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • python-tornado-debugsource-0:6.5.8-0.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.1?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • python3-tornado-debuginfo-0:6.5.8-0.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.1?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5_ppc64le as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1791863220

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:15cbddf62271d0006cf17408e0cad81f761bb40d249b04f5cfbb648f75a8d12e_amd64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256%3A15cbddf62271d0006cf17408e0cad81f761bb40d249b04f5cfbb648f75a8d12e?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9&tag=1791572004

    • vendor fix: For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9@sha256:c9af3e533dc72677dbccc165b35560bba4d532cb89ce8ec8eb20a1b78a33857f_arm64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-th-torch-cpu-py312-rhel9@sha256%3Ac9af3e533dc72677dbccc165b35560bba4d532cb89ce8ec8eb20a1b78a33857f?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9&tag=1791926611

    • vendor fix: For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:5012f7e9e8bc59eb0711abae755bf204a323bdf830b72d00abe09409df1a1a98_ppc64le as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3A5012f7e9e8bc59eb0711abae755bf204a323bdf830b72d00abe09409df1a1a98?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1791903880

    • vendor fix: For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256:b749004f18e77c7771f1f930dede6c0548272fd9cdb433584fb95667fcca6d7a_amd64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256%3Ab749004f18e77c7771f1f930dede6c0548272fd9cdb433584fb95667fcca6d7a?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9&tag=1791817064

    • vendor fix: For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:db6a0ea898c0853a01aae3365846d20463e812bd196d6aeaa76c2e53a14fe735_arm64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256%3Adb6a0ea898c0853a01aae3365846d20463e812bd196d6aeaa76c2e53a14fe735?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9&tag=1791816316

    • vendor fix: For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/vulnerability-analysis-rhel9?repository_url=registry.redhat.io/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • lightspeed-core/rag-tool-cuda-12.9-rhel9 as a component of Lightspeed Core · known affected

    Vendor assessment for this product only.

    pkg:oci/rag-tool-cuda-12.9-rhel9?repository_url=registry.redhat.io/lightspeed-core/rag-tool-cuda-12.9-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/disk-image-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-th06-cuda130-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhosp-rhel8/openstack-cinder-backup as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-cinder-backup?repository_url=registry.redhat.io/rhosp-rhel8/openstack-cinder-backup

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhosp-rhel8/openstack-manila-share as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-manila-share?repository_url=registry.redhat.io/rhosp-rhel8/openstack-manila-share

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhosp-rhel8/openstack-rabbitmq as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-rabbitmq?repository_url=registry.redhat.io/rhosp-rhel8/openstack-rabbitmq

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhosp-rhel9/openstack-cinder-volume as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-cinder-volume?repository_url=registry.redhat.io/rhosp-rhel9/openstack-cinder-volume

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhosp-rhel9/openstack-mariadb as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-mariadb?repository_url=registry.redhat.io/rhosp-rhel9/openstack-mariadb

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • rhosp-rhel9/openstack-redis as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-redis?repository_url=registry.redhat.io/rhosp-rhel9/openstack-redis

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:a21805a5c74782894d48fdb289a32bf2418a2baa3afa9fd6a4acfbaf8d3be1d5_amd64 as a component of Red Hat Ansible Automation Platform 2.7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/aap-must-gather-rhel9@sha256%3Aa21805a5c74782894d48fdb289a32bf2418a2baa3afa9fd6a4acfbaf8d3be1d5?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9&tag=1790929285

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:8b6ab608008858bd3f6b12b514db28d23ed981f7f0c0b0a2ae49fef44c85908b_ppc64le as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-agent-rhel9@sha256%3A8b6ab608008858bd3f6b12b514db28d23ed981f7f0c0b0a2ae49fef44c85908b?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9&tag=1790871143

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:b70b11a6f275589f8d1254a51b843a5b5954146dddcb24c8f92e19b6d7daab21_arm64 as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256%3Ab70b11a6f275589f8d1254a51b843a5b5954146dddcb24c8f92e19b6d7daab21?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9&tag=1791902535

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:5a693d9a9529933822780dd80c18f32b6aec5c771662de8ada0fba3523f7c994_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-guardrails-detector-huggingface-runtime-rhel9@sha256%3A5a693d9a9529933822780dd80c18f32b6aec5c771662de8ada0fba3523f7c994?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9&tag=1791535841

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9@sha256:2ea3fa3d3b381431f9717a367e2ba0ccd01554d30e6c8eda8b166f71bc77db69_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-automl-rhel9@sha256%3A2ea3fa3d3b381431f9717a367e2ba0ccd01554d30e6c8eda8b166f71bc77db69?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9&tag=1791861032

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9@sha256:6431a5caa8695d1b25a3e9909284cc9281183bd0938eb598a30e408c91a8f1cf_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-th06-cpu-torch210-py312-rhel9@sha256%3A6431a5caa8695d1b25a3e9909284cc9281183bd0938eb598a30e408c91a8f1cf?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9&tag=1791874335

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:9ad11770d0d96053e7e68f966221fa06a9eb3bb1301fe9e0e36dc8b05a519322_ppc64le as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9@sha256%3A9ad11770d0d96053e7e68f966221fa06a9eb3bb1301fe9e0e36dc8b05a519322?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9&tag=1791946467

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9@sha256:6e00252d385f6707ea21cca6661a3b0dfb9aea1dc2ba9d059b010af772a54b0f_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-batch-gateway-processor-rhel9@sha256%3A6e00252d385f6707ea21cca6661a3b0dfb9aea1dc2ba9d059b010af772a54b0f?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9&tag=1791949062

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:35dd5bcbd549c901880e8ff5c59390d48dc76f108f3af20fa1eab85fa6691255_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-rhel9@sha256%3A35dd5bcbd549c901880e8ff5c59390d48dc76f108f3af20fa1eab85fa6691255?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9&tag=1791951449

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00
  • python-pep517.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-91990 · Updated 2026-10-22T05:22:45+00:00

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS