Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-4427 (GCVE-0-2026-4427)
Vulnerability from cvelistv5 – Published: 2026-03-19 14:24 – Updated: 2026-03-30 07:59Duplicate of CVE-2026-32286
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-03-30T07:59:41.848Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"rejectedReasons": [
{
"lang": "en",
"value": "Duplicate of CVE-2026-32286"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-4427",
"datePublished": "2026-03-19T14:24:02.864Z",
"dateRejected": "2026-03-30T07:59:41.848Z",
"dateReserved": "2026-03-19T12:54:24.750Z",
"dateUpdated": "2026-03-30T07:59:41.848Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-4427\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-03-19T15:16:28.710\",\"lastModified\":\"2026-03-30T08:16:18.573\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: Duplicate of CVE-2026-32286\"}],\"metrics\":{},\"references\":[]}}",
"redhat_vex": {
"aggregate_severity": "None",
"current_release_date": "2026-08-13T14:56:48+00:00",
"cve": "CVE-2026-4427",
"id": "CVE-2026-4427",
"initial_release_date": "2026-03-18T13:00:31+00:00",
"product_status:fixed": "115",
"product_status:known_affected": "25",
"product_status:known_not_affected": "279",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4427.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-07-15T05:41:04Z",
"cve": "CVE-2026-4427",
"id": "CVE-2026-4427",
"initial_release_date": "2026-03-20T00:29:38Z",
"product_status:recommended": "25",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-4427",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-4427.json",
"version": "6"
},
"vulnrichment": {
"containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"Duplicate of CVE-2026-32286\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-03-30T07:59:41.848Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-4427\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"state\": \"REJECTED\", \"assignerShortName\": \"redhat\", \"dateReserved\": \"2026-03-19T12:54:24.750Z\", \"datePublished\": \"2026-03-19T14:24:02.864Z\", \"dateUpdated\": \"2026-03-30T07:59:41.848Z\", \"dateRejected\": \"2026-03-30T07:59:41.848Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:24853
Vulnerability from csaf_redhat - Published: 2026-06-09 15:31 - Updated: 2026-08-15 05:05A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
No description is available for this CVE.
CWE-129 - Improper Validation of Array Index| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.15.5 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.15.5",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:24853",
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2377",
"url": "https://access.redhat.com/security/cve/CVE-2026-2377"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32286",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32589",
"url": "https://access.redhat.com/security/cve/CVE-2026-32589"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33894",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39892",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40192",
"url": "https://access.redhat.com/security/cve/CVE-2026-40192"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40895",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42033",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42035",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42041",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42043",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42044",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24853.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.15.5",
"tracking": {
"current_release_date": "2026-08-15T05:05:23+00:00",
"generator": {
"date": "2026-08-15T05:05:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:24853",
"initial_release_date": "2026-06-09T15:31:40+00:00",
"revision_history": [
{
"date": "2026-06-09T15:31:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-15T05:05:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.15",
"product": {
"name": "Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.15::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1780585491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ab1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Adb0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1780585598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Af32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1780590413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Aef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1780894591"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aafeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ad3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ae76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-2377",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-02-11T21:02:44.495000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2439201"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application\u0027s internal network, potentially leading to the disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Due to the intended and supported use case of Openshift Mirror Registry, deployment in an offline or network-isolated environment, the impact for this product has been downgraded to `Moderate`.\n\nEven in case of compromise, the blast radius is restricted to mirror-registry. It can not be escalated outside the core product. This vulnerability has been scored based on the lack of change of scope.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2377"
},
{
"category": "external",
"summary": "RHBZ#2439201",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439201"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2377"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377"
}
],
"release_date": "2026-04-08T16:18:10.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality"
},
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32589",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-03-12T14:43:07.878000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446963"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user\u0027s in-progress image upload.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: insecure direct object reference in BlobUpload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials to the Quay registry. Unauthenticated users cannot exploit this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32589"
},
{
"category": "external",
"summary": "RHBZ#2446963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446963"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32589"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: insecure direct object reference in BlobUpload"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32590",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-03-12T14:43:11.443000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: remote code execution using pickle deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "RHBZ#2446964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mirror-registry: remote code execution using pickle deserialization"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33894",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-27T21:02:52.462999+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "RHBZ#2452464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33894"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc2313#section-8",
"url": "https://datatracker.ietf.org/doc/html/rfc2313#section-8"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp"
},
{
"category": "external",
"summary": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE",
"url": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc8017.html",
"url": "https://www.rfc-editor.org/rfc/rfc8017.html"
}
],
"release_date": "2026-03-27T20:45:49.583000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-39892",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-08T22:00:59.416053+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In default configurations Red Hat products isolate service processes from total system access. Should an attacker be able to exploit this vulnerability their impact will be limited to that service account and they will not have access to the broader system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "RHBZ#2456735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39892"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/08/12",
"url": "http://www.openwall.com/lists/oss-security/2026/04/08/12"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5",
"url": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"
}
],
"release_date": "2026-04-08T20:49:41.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API"
},
{
"cve": "CVE-2026-40192",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-04-16T00:00:49.590876+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library\u0027s failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40192"
},
{
"category": "external",
"summary": "RHBZ#2458856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40192"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628",
"url": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/pull/9521",
"url": "https://github.com/python-pillow/Pillow/pull/9521"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"
}
],
"release_date": "2026-04-15T22:53:56.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing"
},
{
"cve": "CVE-2026-40895",
"cwe": {
"id": "CWE-212",
"name": "Improper Removal of Sensitive Information Before Storage or Transfer"
},
"discovery_date": "2026-04-21T21:02:33.280553+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460297"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "RHBZ#2460297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
}
],
"release_date": "2026-04-21T19:59:59.759000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects"
},
{
"cve": "CVE-2026-42033",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:20.937507+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "RHBZ#2461607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
}
],
"release_date": "2026-04-24T17:36:44.132000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution"
},
{
"cve": "CVE-2026-42035",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:17.109481+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461606"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application\u0027s core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "RHBZ#2461606",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461606"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
}
],
"release_date": "2026-04-24T17:38:07.752000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-42041",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:41.034289+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461629"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "RHBZ#2461629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
"url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
}
],
"release_date": "2026-04-24T17:55:30.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
},
{
"cve": "CVE-2026-42043",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-04-24T19:01:22.552379+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: NO_PROXY bypass via crafted URL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "RHBZ#2461626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
}
],
"release_date": "2026-04-24T17:54:42.668000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: NO_PROXY bypass via crafted URL"
},
{
"cve": "CVE-2026-42044",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:13.418725+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "RHBZ#2461624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
}
],
"release_date": "2026-04-24T17:49:49.517000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
}
]
}
RHSA-2026:48085
Vulnerability from csaf_redhat - Published: 2026-07-29 17:45 - Updated: 2026-08-15 05:05No description is available for this CVE.
CWE-129 - Improper Validation of Array Index| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.18.0 is now available with bug fixes and feature enhancements.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.18.0",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48085",
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48085.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.18.0",
"tracking": {
"current_release_date": "2026-08-15T05:05:23+00:00",
"generator": {
"date": "2026-08-15T05:05:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48085",
"initial_release_date": "2026-07-29T17:45:57+00:00",
"revision_history": [
{
"date": "2026-07-29T17:45:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-15T05:05:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.18",
"product": {
"name": "Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784987883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Ae07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1785239883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Ada29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3A8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1785155359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3Af71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3A71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Abde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3Abc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Af2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3Af720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Aef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Ac5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3A4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Afd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Aa3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3A7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32590",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-03-12T14:43:11.443000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: remote code execution using pickle deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "RHBZ#2446964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mirror-registry: remote code execution using pickle deserialization"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
}
]
}
rlsa-2026:22450
Vulnerability from osv_rocky
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
-
golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
-
golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
-
crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
-
crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
-
net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
-
github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)
-
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
-
github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)
-
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
-
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
-
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:10",
"name": "osbuild-composer",
"purl": "pkg:rpm/rocky-linux/osbuild-composer?distro=rocky-linux-10\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:165.1-2.el10_2.rocky.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:22450",
"modified": "2026-06-19T12:06:07.724068Z",
"published": "2026-06-05T12:04:50.053452Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:22450"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Important: osbuild-composer security update",
"upstream": [
"CVE-2025-61726",
"CVE-2025-61728",
"CVE-2025-68121",
"CVE-2026-25679",
"CVE-2026-27137",
"CVE-2026-32282",
"CVE-2026-32283",
"CVE-2026-32286",
"CVE-2026-33186",
"CVE-2026-34986",
"CVE-2026-4427"
]
}
rlsa-2026:22714
Vulnerability from osv_rocky
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
-
golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
-
golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
-
crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
-
crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
-
net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
-
github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)
-
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
-
github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)
-
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
-
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
-
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:9",
"name": "osbuild-composer",
"purl": "pkg:rpm/rocky-linux/osbuild-composer?distro=rocky-linux-9\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:165.1-2.el9_8.rocky.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:22714",
"modified": "2026-06-25T12:06:31.151159Z",
"published": "2026-06-11T12:03:24.031456Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:22714"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Important: osbuild-composer security update",
"upstream": [
"CVE-2025-61726",
"CVE-2025-61728",
"CVE-2025-68121",
"CVE-2026-25679",
"CVE-2026-27137",
"CVE-2026-32282",
"CVE-2026-32283",
"CVE-2026-32286",
"CVE-2026-33186",
"CVE-2026-34986",
"CVE-2026-4427"
]
}
SUSE-SU-2026:21793-1
Vulnerability from csaf_suse - Published: 2026-05-14 15:04 - Updated: 2026-05-14 15:04| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64 | — |
Vendor Fix
|
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/s… | self |
| https://www.suse.com/support/update/announcement/… | self |
| https://lists.suse.com/pipermail/sle-updates/2026… | self |
| https://bugzilla.suse.com/1258099 | self |
| https://bugzilla.suse.com/1258609 | self |
| https://bugzilla.suse.com/1259919 | self |
| https://bugzilla.suse.com/1260317 | self |
| https://www.suse.com/security/cve/CVE-2026-25934/ | self |
| https://www.suse.com/security/cve/CVE-2026-26958/ | self |
| https://www.suse.com/security/cve/CVE-2026-33186/ | self |
| https://www.suse.com/security/cve/CVE-2026-4427/ | self |
| https://www.suse.com/security/cve/CVE-2026-25934 | external |
| https://bugzilla.suse.com/1258093 | external |
| https://www.suse.com/security/cve/CVE-2026-26958 | external |
| https://bugzilla.suse.com/1258570 | external |
| https://www.suse.com/security/cve/CVE-2026-33186 | external |
| https://bugzilla.suse.com/1260085 | external |
| https://www.suse.com/security/cve/CVE-2026-4427 | external |
| https://bugzilla.suse.com/1259910 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for alloy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for alloy fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server\n to crash a client application via a DataRow message (bsc#1259919).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n can lead to the consumption of corrupted files (bsc#1258099).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n and lead to undefined behavior (bsc#1258609).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n header (bsc#1260317).\n\nNon security issue:\n\n- Updated to 1.16.0\n- Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-747",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21793-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:21793-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621793-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:21793-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-May/046820.html"
},
{
"category": "self",
"summary": "SUSE Bug 1258099",
"url": "https://bugzilla.suse.com/1258099"
},
{
"category": "self",
"summary": "SUSE Bug 1258609",
"url": "https://bugzilla.suse.com/1258609"
},
{
"category": "self",
"summary": "SUSE Bug 1259919",
"url": "https://bugzilla.suse.com/1259919"
},
{
"category": "self",
"summary": "SUSE Bug 1260317",
"url": "https://bugzilla.suse.com/1260317"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25934 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25934/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-26958 page",
"url": "https://www.suse.com/security/cve/CVE-2026-26958/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-4427 page",
"url": "https://www.suse.com/security/cve/CVE-2026-4427/"
}
],
"title": "Security update for alloy",
"tracking": {
"current_release_date": "2026-05-14T15:04:53Z",
"generator": {
"date": "2026-05-14T15:04:53Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:21793-1",
"initial_release_date": "2026-05-14T15:04:53Z",
"revision_history": [
{
"date": "2026-05-14T15:04:53Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.16.0-160000.1.1.aarch64",
"product": {
"name": "alloy-1.16.0-160000.1.1.aarch64",
"product_id": "alloy-1.16.0-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.16.0-160000.1.1.ppc64le",
"product": {
"name": "alloy-1.16.0-160000.1.1.ppc64le",
"product_id": "alloy-1.16.0-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.16.0-160000.1.1.s390x",
"product": {
"name": "alloy-1.16.0-160000.1.1.s390x",
"product_id": "alloy-1.16.0-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.16.0-160000.1.1.x86_64",
"product": {
"name": "alloy-1.16.0-160000.1.1.x86_64",
"product_id": "alloy-1.16.0-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64"
},
"product_reference": "alloy-1.16.0-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le"
},
"product_reference": "alloy-1.16.0-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x"
},
"product_reference": "alloy-1.16.0-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64"
},
"product_reference": "alloy-1.16.0-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64"
},
"product_reference": "alloy-1.16.0-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le"
},
"product_reference": "alloy-1.16.0-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x"
},
"product_reference": "alloy-1.16.0-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.16.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
},
"product_reference": "alloy-1.16.0-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25934",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25934"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25934",
"url": "https://www.suse.com/security/cve/CVE-2026-25934"
},
{
"category": "external",
"summary": "SUSE Bug 1258093 for CVE-2026-25934",
"url": "https://bugzilla.suse.com/1258093"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T15:04:53Z",
"details": "moderate"
}
],
"title": "CVE-2026-25934"
},
{
"cve": "CVE-2026-26958",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-26958"
}
],
"notes": [
{
"category": "general",
"text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-26958",
"url": "https://www.suse.com/security/cve/CVE-2026-26958"
},
{
"category": "external",
"summary": "SUSE Bug 1258570 for CVE-2026-26958",
"url": "https://bugzilla.suse.com/1258570"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T15:04:53Z",
"details": "moderate"
}
],
"title": "CVE-2026-26958"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T15:04:53Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-4427",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-4427"
}
],
"notes": [
{
"category": "general",
"text": "Duplicate of CVE-2026-32286",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-4427",
"url": "https://www.suse.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "SUSE Bug 1259910 for CVE-2026-4427",
"url": "https://bugzilla.suse.com/1259910"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-14T15:04:53Z",
"details": "important"
}
],
"title": "CVE-2026-4427"
}
]
}
ubuntu-cve-2026-4427
Vulnerability from osv_ubuntu
A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-jackc-pgproto3-v2-dev",
"binary_version": "2.3.2-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "golang-github-jackc-pgproto3",
"purl": "pkg:deb/ubuntu/golang-github-jackc-pgproto3@2.3.2-1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.2.0-2",
"2.3.2-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-jackc-pgproto3-v2-dev",
"binary_version": "2.3.2-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "golang-github-jackc-pgproto3",
"purl": "pkg:deb/ubuntu/golang-github-jackc-pgproto3@2.3.2-1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3.2-1"
]
}
],
"aliases": [],
"details": "A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.",
"id": "UBUNTU-CVE-2026-4427",
"modified": "2026-03-25T17:34:55Z",
"published": "2026-03-19T15:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-4427"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"type": "REPORT",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"type": "REPORT",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"type": "REPORT",
"url": "https://github.com/jackc/pgproto3"
},
{
"type": "REPORT",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-4427"
],
"withdrawn": "2026-04-02T17:29:39Z"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.