From 03c042f772d9400132b0febf6bf43d96dfabdeb0 Mon Sep 17 00:00:00 2001 From: Lawrence Lane Date: Fri, 3 Apr 2026 11:51:32 -0400 Subject: [PATCH 1/3] docs: add release notes and container docs for CVE fixes (PR #1612) Document four HIGH-severity CVE fixes (nemo-toolkit RCE, xgrammar DoS, jackson-core DoS) and dependency updates (pynvml removal) in the 26.04 release notes. Add security hardening section to container environments page for the ray_dist.jar removal. Signed-off-by: Lawrence Lane Co-Authored-By: Claude Opus 4.6 Signed-off-by: Lawrence Lane --- .../v26.04/pages/about/release-notes/index.mdx | 13 +++++++++++++ .../infrastructure/container-environments.mdx | 8 ++++++++ 2 files changed, 21 insertions(+) diff --git a/fern/versions/v26.04/pages/about/release-notes/index.mdx b/fern/versions/v26.04/pages/about/release-notes/index.mdx index 9d29d003db..81b16d2707 100644 --- a/fern/versions/v26.04/pages/about/release-notes/index.mdx +++ b/fern/versions/v26.04/pages/about/release-notes/index.mdx @@ -75,11 +75,24 @@ The exact deduplication identification stage now supports batched insertion into - **New `identification_batchsize` parameter** on `ExactDeduplicationWorkflow`: Controls how many input blocks are concatenated and inserted together. For example, an `input_blocksize` of `256MiB` with `identification_batchsize=4` processes ~1 GB of data per insertion call. - **Batch-aware shuffle adapter**: The Ray actor pool shuffle adapter now automatically uses `read_and_insert_batch` when a stage provides it, falling back to single-task processing otherwise. +## Security Fixes + +### CVE Fixes for Audio and Inference Dependencies (PR #1612) + +Resolved four HIGH-severity CVEs affecting Curator dependencies: + +- **nemo-toolkit RCE (CVE-2025-33245, CVE-2025-33253)**: NeMo Toolkit versions before 2.6.1 used `torch.load()` and `pickle.load()` without `weights_only=True` when loading model checkpoints, enabling remote code execution through maliciously crafted `.nemo` or `.ckpt` files. Curator's `InferenceAsrNemoStage` calls `ASRModel.from_pretrained()`, which uses this deserialization path. Fixed by bumping `nemo_toolkit[asr]` from `==2.4.0` to `>=2.7.2`. +- **xgrammar DoS (CVE-2026-25048)**: Constructing a grammar rule with deeply nested parentheses triggered a segfault via uncontrolled recursion in xgrammar's syntax parsing, which could crash applications using vLLM structured output without authentication. Fixed by overriding vLLM's `xgrammar==0.1.29` pin to `>=0.1.32`. +- **jackson-core DoS (GHSA-72hv-8253-57qq)**: The non-blocking JSON parser in jackson-core 2.16.1, bundled inside `ray_dist.jar` in the Ray Python package, bypassed the `maxNumberLength` constraint, allowing denial of service through arbitrarily long JSON numbers. Since Curator does not use Ray's Java support, the JAR is now deleted during the Docker image build with a build-time verification guard. This fix applies only to the container image. + ## Dependency Updates - **Cosmos-Xenna**: Updated from 0.1.2 to 0.2.0 with simplified resource model - **Ray**: Updated to 2.54 - **uv**: Added minimum required version (>=0.7.0) to prevent lockfile revision drift +- **nemo-toolkit**: Bumped `nemo_toolkit[asr]` from `==2.4.0` to `>=2.7.2` to address deserialization CVEs. Only affects `audio_cpu` and `audio_cuda12` extras. +- **xgrammar**: Moved from `constraint-dependencies` (`>=0.1.21`) to `override-dependencies` (`>=0.1.32`) to override vLLM's pinned version and address CVE-2026-25048. +- **pynvml**: Removed redundant `pynvml` dependency from the `cuda12` extra since `nvidia-ml-py` already provides the same functionality. ## Bug Fixes diff --git a/fern/versions/v26.04/pages/reference/infrastructure/container-environments.mdx b/fern/versions/v26.04/pages/reference/infrastructure/container-environments.mdx index 43f3bf9cba..552b94f00f 100644 --- a/fern/versions/v26.04/pages/reference/infrastructure/container-environments.mdx +++ b/fern/versions/v26.04/pages/reference/infrastructure/container-environments.mdx @@ -65,6 +65,14 @@ The primary container includes comprehensive support for all curation modalities --- +## Security Hardening + +The container build includes the following security measures: + +- **`ray_dist.jar` removal**: Ray's Java support JAR is deleted during the build to remove a bundled jackson-core library affected by [GHSA-72hv-8253-57qq](https://github.com/advisories/GHSA-72hv-8253-57qq) (DoS via async JSON parser). NeMo Curator does not use Ray's Java support, so this has no functional impact. A build-time verification guard fails the build if the JAR is not successfully removed. + +--- + ## Container Build Arguments The main container accepts these build-time arguments for environment customization: From a60fca39e59d664b08e9979452b479433dfb5ca6 Mon Sep 17 00:00:00 2001 From: Lawrence Lane Date: Fri, 3 Apr 2026 11:58:42 -0400 Subject: [PATCH 2/3] docs: fix CVE vs GHSA terminology and clarify nemo-toolkit version range Address review feedback: - Change "four HIGH-severity CVEs" to "four HIGH-severity vulnerabilities" since GHSA-72hv-8253-57qq is a GitHub Security Advisory, not a CVE. - Clarify that the nemo-toolkit CVE was fixed in 2.6.1 but bumped to >=2.7.2 for additional fixes and dependency compatibility. Signed-off-by: Lawrence Lane Co-Authored-By: Claude Opus 4.6 Signed-off-by: Lawrence Lane --- fern/versions/v26.04/pages/about/release-notes/index.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fern/versions/v26.04/pages/about/release-notes/index.mdx b/fern/versions/v26.04/pages/about/release-notes/index.mdx index 81b16d2707..a3729dfef6 100644 --- a/fern/versions/v26.04/pages/about/release-notes/index.mdx +++ b/fern/versions/v26.04/pages/about/release-notes/index.mdx @@ -79,9 +79,9 @@ The exact deduplication identification stage now supports batched insertion into ### CVE Fixes for Audio and Inference Dependencies (PR #1612) -Resolved four HIGH-severity CVEs affecting Curator dependencies: +Resolved four HIGH-severity vulnerabilities affecting Curator dependencies: -- **nemo-toolkit RCE (CVE-2025-33245, CVE-2025-33253)**: NeMo Toolkit versions before 2.6.1 used `torch.load()` and `pickle.load()` without `weights_only=True` when loading model checkpoints, enabling remote code execution through maliciously crafted `.nemo` or `.ckpt` files. Curator's `InferenceAsrNemoStage` calls `ASRModel.from_pretrained()`, which uses this deserialization path. Fixed by bumping `nemo_toolkit[asr]` from `==2.4.0` to `>=2.7.2`. +- **nemo-toolkit RCE (CVE-2025-33245, CVE-2025-33253)**: NeMo Toolkit versions before 2.6.1 used `torch.load()` and `pickle.load()` without `weights_only=True` when loading model checkpoints, enabling remote code execution through maliciously crafted `.nemo` or `.ckpt` files. Curator's `InferenceAsrNemoStage` calls `ASRModel.from_pretrained()`, which uses this deserialization path. The CVE was fixed in nemo-toolkit 2.6.1; bumped to `>=2.7.2` to pick up additional fixes and ensure compatibility with Curator's dependency set. - **xgrammar DoS (CVE-2026-25048)**: Constructing a grammar rule with deeply nested parentheses triggered a segfault via uncontrolled recursion in xgrammar's syntax parsing, which could crash applications using vLLM structured output without authentication. Fixed by overriding vLLM's `xgrammar==0.1.29` pin to `>=0.1.32`. - **jackson-core DoS (GHSA-72hv-8253-57qq)**: The non-blocking JSON parser in jackson-core 2.16.1, bundled inside `ray_dist.jar` in the Ray Python package, bypassed the `maxNumberLength` constraint, allowing denial of service through arbitrarily long JSON numbers. Since Curator does not use Ray's Java support, the JAR is now deleted during the Docker image build with a build-time verification guard. This fix applies only to the container image. From 765bcb12720fe5f22888762b622b676631663905 Mon Sep 17 00:00:00 2001 From: Lawrence Lane Date: Fri, 3 Apr 2026 13:33:19 -0400 Subject: [PATCH 3/3] docs: remove pynvml dependency note per review feedback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove pynvml entry from Dependency Updates — it was accidentally added this release and was not present in the previous release. Signed-off-by: Logan Lane Co-Authored-By: Claude Opus 4.6 Signed-off-by: Lawrence Lane --- fern/versions/v26.04/pages/about/release-notes/index.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/fern/versions/v26.04/pages/about/release-notes/index.mdx b/fern/versions/v26.04/pages/about/release-notes/index.mdx index a3729dfef6..e244ce4345 100644 --- a/fern/versions/v26.04/pages/about/release-notes/index.mdx +++ b/fern/versions/v26.04/pages/about/release-notes/index.mdx @@ -92,7 +92,6 @@ Resolved four HIGH-severity vulnerabilities affecting Curator dependencies: - **uv**: Added minimum required version (>=0.7.0) to prevent lockfile revision drift - **nemo-toolkit**: Bumped `nemo_toolkit[asr]` from `==2.4.0` to `>=2.7.2` to address deserialization CVEs. Only affects `audio_cpu` and `audio_cuda12` extras. - **xgrammar**: Moved from `constraint-dependencies` (`>=0.1.21`) to `override-dependencies` (`>=0.1.32`) to override vLLM's pinned version and address CVE-2026-25048. -- **pynvml**: Removed redundant `pynvml` dependency from the `cuda12` extra since `nvidia-ml-py` already provides the same functionality. ## Bug Fixes