RHSA-2025:23531HighCVSS 8.8

Red Hat Security Advisory: RHOAI 2.25.1 - Red Hat OpenShift AI

Published
December 17, 2025
Last Modified
May 28, 2026

🔗 CVE IDs covered (12)

CVE-2025-64756 →CVE-2025-53643 →CVE-2025-62164 →CVE-2025-62727 →CVE-2025-66416 →CVE-2025-9905 →CVE-2025-9906 →CVE-2025-12060 →CVE-2025-12638 →CVE-2025-47913 →CVE-2025-49655 →CVE-2025-62593 →

📋 Description

CVE-2025-9905 — keras: Arbitary Code execution in Keras load_model() CVE-2025-9906 — keras: Arbitrary Code execution in Keras Safe Mode CVE-2025-12060 — keras: Keras Path Traversal Vulnerability CVE-2025-12638 — keras: Path Traversal Vulnerability in keras CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-49655 — keras: Keras deserialization of untrusted data CVE-2025-53643 — aiohttp: AIOHTTP HTTP Request/Response Smuggling CVE-2025-62164 — vllm: VLLM deserialization vulnerability leading to DoS and potential RCE CVE-2025-62593 — ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62727 — starlette: Starlette DoS via Range header merging CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-66416 — mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK

🔗 References (16)