Description (CNA)
A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat OpenShift AI 2.25 | unaffected 1785260280 before * |
| Red Hat / Red Hat OpenShift AI 3.3 | unaffected 1785262015 before * |
| Red Hat / Red Hat OpenShift AI 3.4 | unaffected 1785269945 before * |
| Red Hat / Red Hat OpenShift AI 3.4 | unaffected 1791865241 before * |
| Red Hat / Red Hat OpenShift AI 3.5 | unaffected 1786552271 before * |
| Red Hat / Red Hat OpenShift AI 3.5 | unaffected 1786552250 before * |
CWE
CWE-770
References
- https://access.redhat.com/errata/RHSA-2026:53261
- https://access.redhat.com/errata/RHSA-2026:53262
- https://access.redhat.com/errata/RHSA-2026:53263
- https://access.redhat.com/errata/RHSA-2026:60367
- https://access.redhat.com/errata/RHSA-2026:84734
- https://access.redhat.com/security/cve/CVE-2026-18618
- https://bugzilla.redhat.com/show_bug.cgi?id=2510313
ADP enrichment
No English description supplied.
No references supplied.