Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener (Red Hat Red Hat OpenShift AI 2.25)
En bref
- Source
- NVD
- EPSS
- EPSS 0.85 % · centile 58 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.
Faiblesses (CWE)
- CWE-770 — Allocation de ressources sans limite ni régulation
Références
- https://access.redhat.com/errata/RHSA-2026:53261
- https://access.redhat.com/errata/RHSA-2026:53262
- https://access.redhat.com/errata/RHSA-2026:53263
- https://access.redhat.com/errata/RHSA-2026:60367
- https://access.redhat.com/errata/RHSA-2026:84734
- https://access.redhat.com/security/cve/CVE-2026-18618
- https://bugzilla.redhat.com/show_bug.cgi?id=2510313
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · secalert@redhat.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-55825
- GCVE · GCVE-0-2026-18618
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · Red Hat OpenShift AI 2.25 | unaffected 1785260280 < * |
| Red Hat · Red Hat OpenShift AI 3.3 | unaffected 1785262015 < * |
| Red Hat · Red Hat OpenShift AI 3.4 | unaffected 1785269945 < * |
| Red Hat · Red Hat OpenShift AI 3.4 | unaffected 1791865241 < * |
| Red Hat · Red Hat OpenShift AI 3.5 | unaffected 1786552271 < * |
| Red Hat · Red Hat OpenShift AI 3.5 | unaffected 1786552250 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |