{"schema":"vulnpedia.research/1","cve":"CVE-2026-91990","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq","tags":["vendor-advisory","exploit","WEB","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:18:31.715Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:18:31.715Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-15T16:05:11.528Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"},{"source":"nvd","sourceId":"CVE-2026-91990","modified":"2026-09-16T13:42:49.167","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"}]},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart","tags":["third-party-advisory","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:18:31.715Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:18:31.715Z","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart"},{"source":"nvd","sourceId":"CVE-2026-91990","modified":"2026-09-16T13:42:49.167","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart"},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart"}]},{"url":"https://osv.dev/vulnerability/GHSA-8423-8fgw-73vq","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://osv.dev/vulnerability/GHSA-8423-8fgw-73vq"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://osv.dev/vulnerability/GHSA-8423-8fgw-73vq"}]},{"url":"https://github.com/tornadoweb/tornado/pull/3704","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://github.com/tornadoweb/tornado/pull/3704"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://github.com/tornadoweb/tornado/pull/3704"}]},{"url":"https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05"}]},{"url":"https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617"}]},{"url":"https://github.com/tornadoweb/tornado","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://github.com/tornadoweb/tornado"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://github.com/tornadoweb/tornado"}]},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.8","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.8"},{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.8"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91990","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-91990"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533953","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533953"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91990","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-91990"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91990","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91990"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:80741","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:80741"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:67147","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:67147"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:67146","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:67146"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:84734","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:84734"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:86891","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:86891"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:79378","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:79378"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87410","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87410"}]},{"source":"euvd","sourceId":"EUVD-2026-78661","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78661","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-78661","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78661"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","url":"https://osv.dev/vulnerability/GHSA-8423-8fgw-73vq","ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.8"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5b1"],"databaseSpecific":{"last_known_affected_version_range":"<= 6.5.7","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8423-8fgw-73vq/GHSA-8423-8fgw-73vq.json"},"modified":"2026-09-16T03:56:01.992806508Z","origins":[{"source":"ghsa","sourceId":"GHSA-8423-8fgw-73vq","modified":"2026-09-16T03:56:01.992806508Z","url":"https://osv.dev/vulnerability/GHSA-8423-8fgw-73vq"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"AppStream-10.0.Z.E2S:python-tornado-0:6.5.8-0.el10_0.1.src","product":"python-tornado-0:6.5.8-0.el10_0.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80741"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/python-tornado@6.5.8-0.el10_0.1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"AppStream-10.0.Z.E2S:python3-tornado-debuginfo-0:6.5.8-0.el10_0.1.aarch64","product":"python3-tornado-debuginfo-0:6.5.8-0.el10_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80741"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/python3-tornado-debuginfo@6.5.8-0.el10_0.1?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"AppStream-10.2.Z:python3-tornado-0:6.5.8-0.el10_2.1.ppc64le","product":"python3-tornado-0:6.5.8-0.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67147"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/python3-tornado@6.5.8-0.el10_2.1?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:python-tornado-debugsource-0:6.5.8-0.el9_8.1.ppc64le","product":"python-tornado-debugsource-0:6.5.8-0.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67146"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/python-tornado-debugsource@6.5.8-0.el9_8.1?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:python3-tornado-debuginfo-0:6.5.8-0.el9_8.1.x86_64","product":"python3-tornado-debuginfo-0:6.5.8-0.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67146"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/python3-tornado-debuginfo@6.5.8-0.el9_8.1?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5_ppc64le","product":"registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5_ppc64le as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:oci/odh-feature-server-rhel9@sha256%3A5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1791863220","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:15cbddf62271d0006cf17408e0cad81f761bb40d249b04f5cfbb648f75a8d12e_amd64","product":"registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:15cbddf62271d0006cf17408e0cad81f761bb40d249b04f5cfbb648f75a8d12e_amd64 as a component of Red Hat OpenShift AI 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:86891"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:oci/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256%3A15cbddf62271d0006cf17408e0cad81f761bb40d249b04f5cfbb648f75a8d12e?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9&tag=1791572004","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9@sha256:c9af3e533dc72677dbccc165b35560bba4d532cb89ce8ec8eb20a1b78a33857f_arm64","product":"registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9@sha256:c9af3e533dc72677dbccc165b35560bba4d532cb89ce8ec8eb20a1b78a33857f_arm64 as a component of Red Hat OpenShift AI 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:86891"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:oci/odh-th-torch-cpu-py312-rhel9@sha256%3Ac9af3e533dc72677dbccc165b35560bba4d532cb89ce8ec8eb20a1b78a33857f?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9&tag=1791926611","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:5012f7e9e8bc59eb0711abae755bf204a323bdf830b72d00abe09409df1a1a98_ppc64le","product":"registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:5012f7e9e8bc59eb0711abae755bf204a323bdf830b72d00abe09409df1a1a98_ppc64le as a component of Red Hat OpenShift AI 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:86891"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3A5012f7e9e8bc59eb0711abae755bf204a323bdf830b72d00abe09409df1a1a98?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1791903880","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256:b749004f18e77c7771f1f930dede6c0548272fd9cdb433584fb95667fcca6d7a_amd64","product":"registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256:b749004f18e77c7771f1f930dede6c0548272fd9cdb433584fb95667fcca6d7a_amd64 as a component of Red Hat OpenShift AI 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:86891"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:oci/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256%3Ab749004f18e77c7771f1f930dede6c0548272fd9cdb433584fb95667fcca6d7a?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9&tag=1791817064","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:db6a0ea898c0853a01aae3365846d20463e812bd196d6aeaa76c2e53a14fe735_arm64","product":"registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:db6a0ea898c0853a01aae3365846d20463e812bd196d6aeaa76c2e53a14fe735_arm64 as a component of Red Hat OpenShift AI 3.5","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.5.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:86891"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:oci/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256%3Adb6a0ea898c0853a01aae3365846d20463e812bd196d6aeaa76c2e53a14fe735?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9&tag=1791816316","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"exploit_intelligence:exploit-intelligence-tech-preview/vulnerability-analysis-rhel9","product":"exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 as a component of Exploit Intelligence","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:oci/vulnerability-analysis-rhel9?repository_url=registry.redhat.io/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"lightspeed_core:lightspeed-core/rag-tool-cuda-12.9-rhel9","product":"lightspeed-core/rag-tool-cuda-12.9-rhel9 as a component of Lightspeed Core","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/rag-tool-cuda-12.9-rhel9?repository_url=registry.redhat.io/lightspeed-core/rag-tool-cuda-12.9-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9","product":"rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/disk-image-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-th06-cuda130-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openstack_platform_16.2:rhosp-rhel8/openstack-cinder-backup","product":"rhosp-rhel8/openstack-cinder-backup as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-cinder-backup?repository_url=registry.redhat.io/rhosp-rhel8/openstack-cinder-backup","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openstack_platform_16.2:rhosp-rhel8/openstack-manila-share","product":"rhosp-rhel8/openstack-manila-share as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-manila-share?repository_url=registry.redhat.io/rhosp-rhel8/openstack-manila-share","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openstack_platform_16.2:rhosp-rhel8/openstack-rabbitmq","product":"rhosp-rhel8/openstack-rabbitmq as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-rabbitmq?repository_url=registry.redhat.io/rhosp-rhel8/openstack-rabbitmq","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openstack_platform_17.1:rhosp-rhel9/openstack-cinder-volume","product":"rhosp-rhel9/openstack-cinder-volume as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-cinder-volume?repository_url=registry.redhat.io/rhosp-rhel9/openstack-cinder-volume","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openstack_platform_17.1:rhosp-rhel9/openstack-mariadb","product":"rhosp-rhel9/openstack-mariadb as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-mariadb?repository_url=registry.redhat.io/rhosp-rhel9/openstack-mariadb","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openstack_platform_17.1:rhosp-rhel9/openstack-redis","product":"rhosp-rhel9/openstack-redis as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/openstack-redis?repository_url=registry.redhat.io/rhosp-rhel9/openstack-redis","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:a21805a5c74782894d48fdb289a32bf2418a2baa3afa9fd6a4acfbaf8d3be1d5_amd64","product":"registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:a21805a5c74782894d48fdb289a32bf2418a2baa3afa9fd6a4acfbaf8d3be1d5_amd64 as a component of Red Hat Ansible Automation Platform 2.7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/aap-must-gather-rhel9@sha256%3Aa21805a5c74782894d48fdb289a32bf2418a2baa3afa9fd6a4acfbaf8d3be1d5?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9&tag=1790929285","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 2.25:registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:8b6ab608008858bd3f6b12b514db28d23ed981f7f0c0b0a2ae49fef44c85908b_ppc64le","product":"registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:8b6ab608008858bd3f6b12b514db28d23ed981f7f0c0b0a2ae49fef44c85908b_ppc64le as a component of Red Hat OpenShift AI 2.25","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-kserve-agent-rhel9@sha256%3A8b6ab608008858bd3f6b12b514db28d23ed981f7f0c0b0a2ae49fef44c85908b?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9&tag=1790871143","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 2.25:registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:b70b11a6f275589f8d1254a51b843a5b5954146dddcb24c8f92e19b6d7daab21_arm64","product":"registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:b70b11a6f275589f8d1254a51b843a5b5954146dddcb24c8f92e19b6d7daab21_arm64 as a component of Red Hat OpenShift AI 2.25","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256%3Ab70b11a6f275589f8d1254a51b843a5b5954146dddcb24c8f92e19b6d7daab21?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9&tag=1791902535","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:5a693d9a9529933822780dd80c18f32b6aec5c771662de8ada0fba3523f7c994_s390x","product":"registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9@sha256:5a693d9a9529933822780dd80c18f32b6aec5c771662de8ada0fba3523f7c994_s390x as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-guardrails-detector-huggingface-runtime-rhel9@sha256%3A5a693d9a9529933822780dd80c18f32b6aec5c771662de8ada0fba3523f7c994?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9&tag=1791535841","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9@sha256:2ea3fa3d3b381431f9717a367e2ba0ccd01554d30e6c8eda8b166f71bc77db69_ppc64le","product":"registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9@sha256:2ea3fa3d3b381431f9717a367e2ba0ccd01554d30e6c8eda8b166f71bc77db69_ppc64le as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-mod-arch-automl-rhel9@sha256%3A2ea3fa3d3b381431f9717a367e2ba0ccd01554d30e6c8eda8b166f71bc77db69?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9&tag=1791861032","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9@sha256:6431a5caa8695d1b25a3e9909284cc9281183bd0938eb598a30e408c91a8f1cf_amd64","product":"registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9@sha256:6431a5caa8695d1b25a3e9909284cc9281183bd0938eb598a30e408c91a8f1cf_amd64 as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-th06-cpu-torch210-py312-rhel9@sha256%3A6431a5caa8695d1b25a3e9909284cc9281183bd0938eb598a30e408c91a8f1cf?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9&tag=1791874335","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:9ad11770d0d96053e7e68f966221fa06a9eb3bb1301fe9e0e36dc8b05a519322_ppc64le","product":"registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:9ad11770d0d96053e7e68f966221fa06a9eb3bb1301fe9e0e36dc8b05a519322_ppc64le as a component of Red Hat OpenShift AI 3.5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9@sha256%3A9ad11770d0d96053e7e68f966221fa06a9eb3bb1301fe9e0e36dc8b05a519322?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9&tag=1791946467","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9@sha256:6e00252d385f6707ea21cca6661a3b0dfb9aea1dc2ba9d059b010af772a54b0f_amd64","product":"registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9@sha256:6e00252d385f6707ea21cca6661a3b0dfb9aea1dc2ba9d059b010af772a54b0f_amd64 as a component of Red Hat OpenShift AI 3.5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-llm-d-batch-gateway-processor-rhel9@sha256%3A6e00252d385f6707ea21cca6661a3b0dfb9aea1dc2ba9d059b010af772a54b0f?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9&tag=1791949062","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"Red Hat OpenShift AI 3.5:registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:35dd5bcbd549c901880e8ff5c59390d48dc76f108f3af20fa1eab85fa6691255_amd64","product":"registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:35dd5bcbd549c901880e8ff5c59390d48dc76f108f3af20fa1eab85fa6691255_amd64 as a component of Red Hat OpenShift AI 3.5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-model-registry-rhel9@sha256%3A35dd5bcbd549c901880e8ff5c59390d48dc76f108f3af20fa1eab85fa6691255?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9&tag=1791951449","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]},{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json","productId":"red_hat_openshift_container_platform_4:python-pep517.src","product":"python-pep517.src as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/python-pep517@0.13.0-5.2.el9ocp?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-91990","modified":"2026-10-22T05:22:45+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91990.json"}]}],"vendorCoverage":{"total":1047,"shown":32,"omitted":1015,"source":"redhat"}}