Rhoai Odh-Kserve-Router-Rhel9 vulnerabilities

CVE-2026-7141 [MEDIUM] CWE-908 vllm: vllm: Uninitialized resource in KV Block Handler via has_mamba_layers function vllm: vllm: Uninitialized resource in KV Block Handler via has_mamba_layers function A flaw was found in vllm. A remote attacker can exploit a vulnerability in the `has_mamba_layers` function within the KV Block Handler component. By performing a specific manipulation, an uninitialized resource can be triggered, potentially leading to information disclosure or denial of service. T

CVE-2026-41140 [LOW] CWE-22 poetry: python: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction poetry: python: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction A flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the `extractall()` function in Poetry can be tricked into wr

CVE-2026-28684 [MEDIUM] CWE-59 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system. Mitigation: Mitigation for this i

CVE-2026-40347 [MEDIUM] CWE-1050 python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to