RHSA-2025:22759HighCVSS 8.6

Red Hat Security Advisory: RHOAI 2.22.3 - Red Hat OpenShift AI

Published
December 4, 2025
Last Modified
September 14, 2026

🔗 CVE IDs covered (8)

CVE-2025-53643 →CVE-2025-58183 →CVE-2025-58754 →CVE-2025-62156 →CVE-2025-62727 →CVE-2025-9905 →CVE-2025-12060 →CVE-2025-47907 →

📋 Description

CVE-2025-9905 — keras: Arbitary Code execution in Keras load_model() CVE-2025-12060 — keras: Keras Path Traversal Vulnerability CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-53643 — aiohttp: AIOHTTP HTTP Request/Response Smuggling CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-62156 — github.com/argoproj/argo-workflows: Argo Workflows Zip Slip CVE-2025-62727 — starlette: Starlette DoS via Range header merging

🎯 Affected products40

  • Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:8b3e0152680063828a54187feec06600de866db91ab219911b1c3ab50d8b1b7c_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:3f8491f3004efaaf8a508cc7ad139dafae667a3c2f3e31736ade9997e4eb789b_s390x as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:7908a416df1a7a29de0fc89b788c7fb8a3fba85a2e80cd93a52efcf20d0c2fdd_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:bbb139905574a6d29e855a0a6df56f71e036f3e425ee3393a70e384610939259_ppc64le as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:fe5d3cdb7fb4658dc46111d20ee03b890b438458ee7d20a55871d59a35a3b926_arm64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:86ac0f8f1d05b6fb02523108448414ec494d630544b3eb6de2f1ad593e67f704_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:c7456669d7f87f0194f4dd38559c73d75c441027c25cd487a24b25d7539f917d_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:f27180fd3c4c24fdc014bf09554a16a598a4215d7e9d1106015d7b5e976167fe_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-feast-operator-rhel9@sha256:3fa33fb9fd238dda3dd0dbc5243d0ec3e82083fb9ecf557a5f8a5b67afc77ba8_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:d5d52b368050d505183452f1d8b5170c86f7473fd869a886777d3bf7e48aad76_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:687875287e4317041637f6b47741e484df49e3b2d55ef871021e4ac9f0d99886_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-kuberay-operator-controller-rhel9@sha256:2d796962cc7622fcc7eb0456eb70439cbb04a5e679f7de8826416a99a9851c62_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:b7de90247a93ad5b39c83be7cea5ba4a36d1cb55a37179157433edce2d2a9c63_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel9@sha256:854eb235c46dc89cbd324d4b632ff0d07840d3e60744c66e9be8298d3d3d4631_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel9@sha256:f092ae49cdb78c33c051718472448bfd16d4d50918116b3fe988dec267abd2bb_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:46a17b6f764f05a7f81ce3d9c01dd24f11049bfc9f625a4953fd68f7935fe2a4_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9@sha256:3cbc5336af0b8c06c641d864d7b45ce04576e38dbc8636573abb94c37eedeb18_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-ml-pipelines-runtime-generic-rhel9@sha256:65a5dbc53f8f89bf05f4eac1081c022d3d7459917025c8e99a684f6be679eb98_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9@sha256:8c97392bb11def5cf310f7992d19d22b4f015e0040faf0fe59044ac63c186d2f_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel9@sha256:bfa7bfad599fed7e758dcd892f6a207144070daf288339b25186f94e8b763a1b_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel9@sha256:974ebc1a016a1ccac1683fee653afedd2628e2315cf2cc726b40fb5135aaca93_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:0bd79a7eecc255d6d69acd0002c517652638cdf31a0014aa534bf8e3b233b667_arm64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:0f03bb40db834eb444df20dd54473d082ccc6816df6efa0e6166dcaf8c86e3ab_s390x as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:65953d54df30fcba632c78d2bdabce81796413baeee6a826d0815df45b99d527_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:f43e263fe3aafc8db04394c9132ec7d7cc2b836fc690cd37b1a8892137ea8773_ppc64le as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-model-registry-operator-rhel9@sha256:901efe4e9867390a89d61d5c945b72b5e2db87202c919a43579f0ca7cfa4cf96_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:e0a67c5465369eae8e98ccee093dd09f5ccdb445903e2aaec30c978b2b7f10f3_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-modelmesh-rhel9@sha256:a3c3c17e6092e760923a8b68c98c6d26c30f81da2f04f0d2e9727461254c7c1a_amd64 as a component of Red Hat OpenShift AI 2.22
  • registry.redhat.io/rhoai/odh-modelmesh-runtime-adapter-rhel9@sha256:1dd295d8062d8846ffb2534b2597e2791bd67387904b3d4ccf58cf3424d3250b_amd64 as a component of Red Hat OpenShift AI 2.22
  • +10 more not shown

✅ Remediation

For Red Hat OpenShift AI 2.22.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (12)