RHSA-2026:94461HighCVSS 9.1

Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (Spyre)

Published
November 3, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (3)

CVE-2026-96889 →CVE-2026-111497 →CVE-2026-44172 →

📋 Description

CVE-2026-44172 — mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-96889 — librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder

🎯 Affected products4

  • Red Hat OpenShift AI 3.4
  • registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:213ef2e7b26a3000398f91a71ccdbb421750809ec05051abf07a4a4ad54af441_ppc64le as a component of Red Hat OpenShift AI 3.4
  • registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:3003decba8baae0946b4ee1fb58ef34d1bfe12b83fca8d5fe45d10bd7f022316_amd64 as a component of Red Hat OpenShift AI 3.4
  • registry.redhat.io/rhai/base-image-spyre-rhel9@sha256:df5a93b241f0582b1051536b18ee7c58db8fa3172d06829cf0d6c466c9614565_s390x as a component of Red Hat OpenShift AI 3.4

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:94461 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (7)