RHSA-2026:74511

Vulnerability from csaf_redhat - Published: 2026-10-01 14:57 - Updated: 2026-10-02 17:45
Summary
Red Hat Security Advisory: Red Hat Quay 3.17.5
Severity
Important
Notes
Topic: Red Hat Quay 3.17.5 is now available with bug fixes.
Details: Quay 3.17.5
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-15792

A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service (DoS), making the BuildKit service unavailable.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64 —
Workaround
Unresolved product id: Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x —
Workaround
Threats
Impact Moderate
CVE-2026-16221

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-18255

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-863 - Incorrect Authorization
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-39820

A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-39822

A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-42151

A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-256 - Plaintext Storage of a Password
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-42154

A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-42499

A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1046 - Creation of Immutable Text Using String Concatenation
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-44705

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-49477

A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 - Inefficient Regular Expression Complexity
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-49825

A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user's browser.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-166 - Improper Handling of Missing Special Element
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-54770

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.

7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-67213

A flaw was found in nanoid (Nano ID), a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service (DoS) condition by hanging the application's calling thread.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-67214

A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-839 - Numeric Range Comparison Without Minimum Check
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-67314

A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-67321

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-69153

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Moderate
CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker's host as legitimate.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 4 products, the same list as for CVE-2026-15792
Known not affected 27 products, the same list as for CVE-2026-15792
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:74511 self
https://access.redhat.com/security/cve/CVE-2026-15792 external
https://access.redhat.com/security/cve/CVE-2026-16221 external
https://access.redhat.com/security/cve/CVE-2026-18255 external
https://access.redhat.com/security/cve/CVE-2026-33818 external
https://access.redhat.com/security/cve/CVE-2026-39820 external
https://access.redhat.com/security/cve/CVE-2026-39822 external
https://access.redhat.com/security/cve/CVE-2026-42151 external
https://access.redhat.com/security/cve/CVE-2026-42154 external
https://access.redhat.com/security/cve/CVE-2026-42499 external
https://access.redhat.com/security/cve/CVE-2026-42504 external
https://access.redhat.com/security/cve/CVE-2026-44705 external
https://access.redhat.com/security/cve/CVE-2026-49477 external
https://access.redhat.com/security/cve/CVE-2026-49825 external
https://access.redhat.com/security/cve/CVE-2026-54770 external
https://access.redhat.com/security/cve/CVE-2026-56852 external
https://access.redhat.com/security/cve/CVE-2026-56853 external
https://access.redhat.com/security/cve/CVE-2026-56858 external
https://access.redhat.com/security/cve/CVE-2026-56859 external
https://access.redhat.com/security/cve/CVE-2026-56860 external
https://access.redhat.com/security/cve/CVE-2026-56862 external
https://access.redhat.com/security/cve/CVE-2026-67213 external
https://access.redhat.com/security/cve/CVE-2026-67214 external
https://access.redhat.com/security/cve/CVE-2026-67313 external
https://access.redhat.com/security/cve/CVE-2026-67314 external
https://access.redhat.com/security/cve/CVE-2026-67320 external
https://access.redhat.com/security/cve/CVE-2026-67321 external
https://access.redhat.com/security/cve/CVE-2026-69153 external
https://access.redhat.com/security/cve/CVE-2026-84292 external
https://access.redhat.com/security/cve/CVE-2026-84394 external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-15792 self
https://bugzilla.redhat.com/show_bug.cgi?id=2503746 external
https://www.cve.org/CVERecord?id=CVE-2026-15792 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15792 external
https://github.com/moby/buildkit/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-16221 self
https://bugzilla.redhat.com/show_bug.cgi?id=2502307 external
https://www.cve.org/CVERecord?id=CVE-2026-16221 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16221 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-18255 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508454 external
https://www.cve.org/CVERecord?id=CVE-2026-18255 external
https://nvd.nist.gov/vuln/detail/CVE-2026-18255 external
https://access.redhat.com/security/cve/CVE-2026-33818 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 external
https://www.cve.org/CVERecord?id=CVE-2026-33818 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 external
https://go.dev/cl/814980 external
https://go.dev/issue/80405 external
https://groups.google.com/g/golang-announce/c/94p… external
https://pkg.go.dev/vuln/GO-2026-5972 external
https://access.redhat.com/security/cve/CVE-2026-39820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467820 external
https://www.cve.org/CVERecord?id=CVE-2026-39820 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39820 external
https://go.dev/cl/759940 external
https://go.dev/issue/78566 external
https://groups.google.com/g/golang-announce/c/qcC… external
https://pkg.go.dev/vuln/GO-2026-4986 external
https://access.redhat.com/security/cve/CVE-2026-39822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498152 external
https://www.cve.org/CVERecord?id=CVE-2026-39822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39822 external
https://go.dev/cl/797880 external
https://go.dev/issue/79005 external
https://groups.google.com/g/golang-announce/c/Orm… external
https://pkg.go.dev/vuln/GO-2026-4970 external
https://access.redhat.com/security/cve/CVE-2026-42151 self
https://bugzilla.redhat.com/show_bug.cgi?id=2466507 external
https://www.cve.org/CVERecord?id=CVE-2026-42151 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42151 external
https://github.com/prometheus/prometheus/pull/18587 external
https://github.com/prometheus/prometheus/pull/18590 external
https://github.com/prometheus/prometheus/releases… external
https://github.com/prometheus/prometheus/releases… external
https://github.com/prometheus/prometheus/security… external
https://access.redhat.com/security/cve/CVE-2026-42154 self
https://bugzilla.redhat.com/show_bug.cgi?id=2466505 external
https://www.cve.org/CVERecord?id=CVE-2026-42154 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42154 external
https://github.com/prometheus/prometheus/pull/18584 external
https://github.com/prometheus/prometheus/pull/18585 external
https://github.com/prometheus/prometheus/security… external
https://access.redhat.com/security/cve/CVE-2026-42499 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467809 external
https://www.cve.org/CVERecord?id=CVE-2026-42499 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42499 external
https://go.dev/cl/771520 external
https://go.dev/issue/78987 external
https://pkg.go.dev/vuln/GO-2026-4977 external
https://access.redhat.com/security/cve/CVE-2026-42504 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 external
https://www.cve.org/CVERecord?id=CVE-2026-42504 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504 external
https://go.dev/cl/774481 external
https://go.dev/issue/79217 external
https://groups.google.com/g/golang-announce/c/tKs… external
https://pkg.go.dev/vuln/GO-2026-5038 external
https://access.redhat.com/security/cve/CVE-2026-44705 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487946 external
https://www.cve.org/CVERecord?id=CVE-2026-44705 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44705 external
https://github.com/raszi/node-tmp/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-49477 self
https://bugzilla.redhat.com/show_bug.cgi?id=2500752 external
https://www.cve.org/CVERecord?id=CVE-2026-49477 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49477 external
https://github.com/facelessuser/soupsieve/commit/… external
https://github.com/facelessuser/soupsieve/release… external
https://github.com/facelessuser/soupsieve/securit… external
https://access.redhat.com/security/cve/CVE-2026-49825 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520368 external
https://www.cve.org/CVERecord?id=CVE-2026-49825 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49825 external
https://github.com/fedora-python/lxml_html_clean/… external
https://github.com/fedora-python/lxml_html_clean/… external
https://github.com/fedora-python/lxml_html_clean/… external
https://github.com/lxml/lxml/commit/5927a6d5e8518… external
https://github.com/lxml/lxml/releases/tag/lxml-6.1.1 external
https://access.redhat.com/security/cve/CVE-2026-54770 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520616 external
https://www.cve.org/CVERecord?id=CVE-2026-54770 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54770 external
https://github.com/Pylons/webob/commit/ff89560643… external
https://github.com/Pylons/webob/security/advisori… external
https://github.com/Pylons/webob/tree/1.8.11 external
https://access.redhat.com/security/cve/CVE-2026-56852 self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233 external
https://www.cve.org/CVERecord?id=CVE-2026-56852 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852 external
https://go.dev/cl/794100 external
https://go.dev/issue/80142 external
https://pkg.go.dev/vuln/GO-2026-5970 external
https://access.redhat.com/security/cve/CVE-2026-56853 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827 external
https://www.cve.org/CVERecord?id=CVE-2026-56853 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853 external
https://go.dev/cl/795540 external
https://go.dev/issue/80205 external
https://pkg.go.dev/vuln/GO-2026-6089 external
https://access.redhat.com/security/cve/CVE-2026-56858 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838 external
https://www.cve.org/CVERecord?id=CVE-2026-56858 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858 external
https://go.dev/cl/807100 external
https://go.dev/issue/80435 external
https://pkg.go.dev/vuln/GO-2026-6091 external
https://access.redhat.com/security/cve/CVE-2026-56859 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840 external
https://www.cve.org/CVERecord?id=CVE-2026-56859 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859 external
https://go.dev/cl/803320 external
https://go.dev/issue/80481 external
https://pkg.go.dev/vuln/GO-2026-6088 external
https://access.redhat.com/security/cve/CVE-2026-56860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 external
https://www.cve.org/CVERecord?id=CVE-2026-56860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 external
https://go.dev/cl/803681 external
https://go.dev/issue/80494 external
https://pkg.go.dev/vuln/GO-2026-6218 external
https://access.redhat.com/security/cve/CVE-2026-56862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 external
https://www.cve.org/CVERecord?id=CVE-2026-56862 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862 external
https://go.dev/cl/804261 external
https://go.dev/issue/80528 external
https://pkg.go.dev/vuln/GO-2026-6090 external
https://access.redhat.com/security/cve/CVE-2026-67213 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508406 external
https://www.cve.org/CVERecord?id=CVE-2026-67213 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67213 external
https://github.com/ai/nanoid/commit/cb3626d0f3342… external
https://github.com/ai/nanoid/releases/tag/5.1.6 external
https://www.vulncheck.com/advisories/nanoid-befor… external
https://access.redhat.com/security/cve/CVE-2026-67214 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508411 external
https://www.cve.org/CVERecord?id=CVE-2026-67214 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67214 external
https://github.com/ai/nanoid/commit/6ccc67bbaba71… external
https://github.com/ai/nanoid/releases/tag/5.1.16 external
https://www.vulncheck.com/advisories/nanoid-befor… external
https://access.redhat.com/security/cve/CVE-2026-67313 self
https://www.cve.org/CVERecord?id=CVE-2026-67313 external
https://access.redhat.com/security/cve/CVE-2026-67314 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510030 external
https://www.cve.org/CVERecord?id=CVE-2026-67314 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67314 external
https://github.com/axios/axios/security/advisorie… external
https://www.vulncheck.com/advisories/axios-before… external
https://access.redhat.com/security/cve/CVE-2026-67320 self
https://bugzilla.redhat.com/show_bug.cgi?id=2509993 external
https://www.cve.org/CVERecord?id=CVE-2026-67320 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67320 external
https://github.com/axios/axios/commit/df53d7dd99b… external
https://github.com/axios/axios/security/advisorie… external
https://www.vulncheck.com/advisories/axios-before… external
https://access.redhat.com/security/cve/CVE-2026-67321 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510011 external
https://www.cve.org/CVERecord?id=CVE-2026-67321 external
https://nvd.nist.gov/vuln/detail/CVE-2026-67321 external
https://github.com/axios/axios/security/advisorie… external
https://www.vulncheck.com/advisories/axios-before… external
https://access.redhat.com/security/cve/CVE-2026-69153 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510719 external
https://www.cve.org/CVERecord?id=CVE-2026-69153 external
https://nvd.nist.gov/vuln/detail/CVE-2026-69153 external
https://github.com/postcss/postcss/commit/7beca13… external
https://github.com/postcss/postcss/releases/tag/8.5.19 external
https://github.com/postcss/postcss/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-84292 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527747 external
https://www.cve.org/CVERecord?id=CVE-2026-84292 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84292 external
https://github.com/fastify/fast-uri/security/advi… external
https://access.redhat.com/security/cve/CVE-2026-84394 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527756 external
https://www.cve.org/CVERecord?id=CVE-2026-84394 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84394 external
https://github.com/fastify/fast-uri/security/advi… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.17.5 is now available with bug fixes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.17.5",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:74511",
        "url": "https://access.redhat.com/errata/RHSA-2026:74511"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15792",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15792"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16221",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16221"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-18255",
        "url": "https://access.redhat.com/security/cve/CVE-2026-18255"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39820"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39822",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39822"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42151"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42154"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44705",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44705"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49825",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54770",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67213",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67213"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67214",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67214"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84394",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74511.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay 3.17.5",
    "tracking": {
      "current_release_date": "2026-10-02T17:45:16+00:00",
      "generator": {
        "date": "2026-10-02T17:45:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:74511",
      "initial_release_date": "2026-10-01T14:57:50+00:00",
      "revision_history": [
        {
          "date": "2026-10-01T14:57:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-02T14:23:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-02T17:45:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.17",
                "product": {
                  "name": "Red Hat Quay 3.17",
                  "product_id": "Red Hat Quay 3.17",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.17::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1790402808"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1790402092"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Abe945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1790404339"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3Aaa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1790403610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1790268950"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3A4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1790484991"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3Aa3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1790689867"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3A1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1790696576"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel9@sha256%3A7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1790689856"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3A7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1790690298"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1790402092"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1790403610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Ad5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1790268950"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3A80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1790484991"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3Ae2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1790689867"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel9@sha256%3A9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1790689856"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3A7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1790690298"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1790402092"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1790403610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1790268950"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3A795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1790484991"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3A743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1790689867"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel9@sha256%3A819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1790689856"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3Add967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1790690298"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Abd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1790402092"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1790403610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Abfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1790268950"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel9@sha256%3A6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1790484991"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel9@sha256%3A7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1790689867"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel9@sha256%3Aa8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1790689856"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel9@sha256%3A08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1790690298"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64 as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le as a component of Red Hat Quay 3.17",
          "product_id": "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.17"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15792",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-07-21T17:01:51.555730+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503746"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service (DoS), making the BuildKit service unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "BuildKit is used by several Red Hat products to build container images. This issue allows a malicious BuildKit frontend or client to cause the BuildKit build process to crash. Exploiting this issue requires the ability to supply a build definition (for example, a Dockerfile specifying a custom #syntax frontend) to a BuildKit-based build; it does not allow remote code execution or exposure of data. The issue is fixed upstream in BuildKit version 0.31.2. Red Hat Hardened Images (Buildah, Podman, and Trivy) has already shipped the fixed version. Other affected Red Hat products are being assessed and will ship the fixed version of BuildKit in upcoming releases.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15792"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503746",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503746"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15792",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15792"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15792",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15792"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6",
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6"
        }
      ],
      "release_date": "2026-07-21T16:10:21.395000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Avoid building container images using BuildKit frontends from untrusted sources. A BuildKit frontend is typically specified using a \"# syntax\" directive at the top of a Dockerfile, or with the \"--frontend\" option to the \"buildctl build\" command. Only use frontend images that come from a trusted source.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request"
    },
    {
      "cve": "CVE-2026-16221",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-19T15:02:40.167601+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502307"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js\u0027s native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in fast-uri allows for a security policy bypass due to inconsistent URL parsing between fast-uri and Node.js\u0027s native WHATWG URL parser. Applications within Red Hat Hardened Images that rely on fast-uri for host-based policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, can be misled by specially crafted URLs. This could enable an attacker to redirect traffic to unintended internal or sensitive network destinations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502307",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502307"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"
        }
      ],
      "release_date": "2026-07-19T14:08:32.993000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency"
    },
    {
      "cve": "CVE-2026-18255",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-07-21T14:34:20+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "quay: quay: Global read-only superuser can view robot account tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18255"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18255",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18255"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18255",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18255"
        }
      ],
      "release_date": "2026-07-21T14:34:20+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "quay: quay: Global read-only superuser can view robot account tokens"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-39820",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-07T20:01:27.800929+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/759940",
          "url": "https://go.dev/cl/759940"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78566",
          "url": "https://go.dev/issue/78566"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4986",
          "url": "https://pkg.go.dev/vuln/GO-2026-4986"
        }
      ],
      "release_date": "2026-05-07T19:41:19.854000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "cve": "CVE-2026-39822",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-07-08T17:01:53.592869+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: Go os.Root: Symlink following vulnerability allows directory traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/797880",
          "url": "https://go.dev/cl/797880"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79005",
          "url": "https://go.dev/issue/79005"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
          "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4970",
          "url": "https://pkg.go.dev/vuln/GO-2026-4970"
        }
      ],
      "release_date": "2026-07-08T15:46:27.199000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "cve": "CVE-2026-42151",
      "cwe": {
        "id": "CWE-256",
        "name": "Plaintext Storage of a Password"
      },
      "discovery_date": "2026-05-04T19:02:26.983660+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466507"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466507",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18587",
          "url": "https://github.com/prometheus/prometheus/pull/18587"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18590",
          "url": "https://github.com/prometheus/prometheus/pull/18590"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
        }
      ],
      "release_date": "2026-05-04T18:12:16.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
    },
    {
      "cve": "CVE-2026-42154",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-04T19:02:19.626646+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42154"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18584",
          "url": "https://github.com/prometheus/prometheus/pull/18584"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18585",
          "url": "https://github.com/prometheus/prometheus/pull/18585"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
        }
      ],
      "release_date": "2026-05-04T18:13:12.340000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
    },
    {
      "cve": "CVE-2026-42499",
      "cwe": {
        "id": "CWE-1046",
        "name": "Creation of Immutable Text Using String Concatenation"
      },
      "discovery_date": "2026-05-07T20:00:51.685602+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/771520",
          "url": "https://go.dev/cl/771520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78987",
          "url": "https://go.dev/issue/78987"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4977",
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "release_date": "2026-05-07T19:41:18.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-44705",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-11T17:01:27.295887+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487946"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Applications that pass user-controlled data to the file or directory creation functions without input sanitization are vulnerable to this issue. This flaw allows files to be created in arbitrary locations with the privileges of the running process. Due to this reason, this vulnerability has been rated with an Important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44705"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487946",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487946"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44705",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44705"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705"
        },
        {
          "category": "external",
          "summary": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65",
          "url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"
        }
      ],
      "release_date": "2026-06-11T15:42:46.565000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape"
    },
    {
      "cve": "CVE-2026-49477",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T22:04:22.677547+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3",
          "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4",
          "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37",
          "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"
        }
      ],
      "release_date": "2026-07-14T20:51:29.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings"
    },
    {
      "cve": "CVE-2026-49825",
      "cwe": {
        "id": "CWE-166",
        "name": "Improper Handling of Missing Special Element"
      },
      "discovery_date": "2026-08-20T15:01:41.793678+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in lxml, a library for processing XML and HTML in Python. The `lxml.html.defs.link_attrs` were missing `xlink:href`, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49825",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2",
          "url": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5",
          "url": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f",
          "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
        },
        {
          "category": "external",
          "summary": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0",
          "url": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0"
        },
        {
          "category": "external",
          "summary": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1",
          "url": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1"
        }
      ],
      "release_date": "2026-08-20T14:42:30.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href"
    },
    {
      "cve": "CVE-2026-54770",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2026-08-20T16:52:08.382509+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an open redirect vulnerability in the WebOb library. An unauthenticated attacker can craft a malicious URL that, when processed by applications utilizing WebOb for redirects, bypasses URL validation. This could lead to users being redirected to attacker-controlled sites, facilitating phishing attacks or the theft of authentication tokens, provided the user follows the redirect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
          "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
          "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/tree/1.8.11",
          "url": "https://github.com/Pylons/webob/tree/1.8.11"
        }
      ],
      "release_date": "2026-08-20T16:31:46.791000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-67213",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-29T14:01:09.009518+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508406"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid (Nano ID), a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service (DoS) condition by hanging the application\u0027s calling thread.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An algorithmic denial of service flaw was found in the `nanoid` library. When calling `customAlphabet` or `customRandom` with a `size` parameter of `0`, the internal generation loop fails to meet its termination condition. In Node.js or browser execution contexts, an attacker who supplies an unvalidated, zero-value size parameter to these functions causes the thread to enter an infinite loop, driving CPU utilization to 100% and completely blocking event loop execution for that thread.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67213"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508406",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508406"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67213",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67213"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67213",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67213"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7",
          "url": "https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.1.6",
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.6"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom",
          "url": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"
        }
      ],
      "release_date": "2026-07-29T13:32:01.534000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure application code validates the size parameter passed to customAlphabet or customRandom, rejecting or sanitizing zero-value inputs before passing them to nanoid.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation"
    },
    {
      "cve": "CVE-2026-67214",
      "cwe": {
        "id": "CWE-839",
        "name": "Numeric Range Comparison Without Minimum Check"
      },
      "discovery_date": "2026-07-29T14:01:28.637584+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library\u0027s non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An input validation flaw in Nano ID\u0027s non-secure module (`nanoid/non-secure`) causes an infinite loop in the `customAlphabet` and `nanoid` functions when processed with a negative size parameter. Because the decrementing loop counter never meets its termination condition, an unauthenticated attacker who passes an unvalidated negative integer value can block the NodeJS event loop, resulting in a thread hang and complete Denial of Service (DoS) for the host application.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67214"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67214",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67214"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67214",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67214"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49",
          "url": "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.1.16",
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.16"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module",
          "url": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"
        }
      ],
      "release_date": "2026-07-29T13:32:02.265000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Sanitize all user-supplied integer inputs before passing them to `nanoid` or `customAlphabet` functions in the `nanoid/non-secure` module, ensuring the size parameter is strictly a non-negative integer.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions"
    },
    {
      "cve": "CVE-2026-67313",
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67320",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:01:50.659496+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "release_date": "2026-08-01T12:22:17.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
    },
    {
      "cve": "CVE-2026-67321",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:02:49.231124+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via object serialization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
        }
      ],
      "release_date": "2026-08-01T12:22:18.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via object serialization bypass"
    },
    {
      "cve": "CVE-2026-69153",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-03T18:01:01.506065+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
          "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
        }
      ],
      "release_date": "2026-08-03T16:56:25.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
    },
    {
      "cve": "CVE-2026-84292",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-09-02T20:21:15.599288+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier (URI) without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the intended host to user information and redirect the authority to an attacker-controlled host, leading to information disclosure as applications interpret the attacker\u0027s host as legitimate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. Applications utilizing the `fast-uri` library in Red Hat environments are susceptible to authority injection if they process untrusted data as the port component of a URI. This could allow an attacker to redirect network traffic to an arbitrary host, compromising communication integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84292"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"
        }
      ],
      "release_date": "2026-09-02T20:09:51.415000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization"
    },
    {
      "cve": "CVE-2026-84394",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-09-02T20:31:21.036047+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policies, such as Server-Side Request Forgery (SSRF) denylists or redirect allowlists, by causing an application to evaluate its policy against an incorrect host string. This could result in unintended network requests or access to unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exploit URI parsing discrepancies to bypass critical host-level access restrictions, such as SSRF filters or reverse proxy routing, without needing elevated privileges. Within Red Hat environments, the issue primarily impacts services that rely on fast-uri to validate external destinations before dispatching requests via Node.js HTTP clients. Product components that only provide frontend interfaces or do not evaluate host security policies using the parsed authority data are not exposed to security filter circumvention.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
          "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84394"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"
        }
      ],
      "release_date": "2026-09-02T20:25:35.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T14:57:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74511"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:743cae8dd741cbdd285581abc24d2d1b54582ca20cd99e2548880be7ffed0c14_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:7ce10d84353efd35ac1905a3e8ec97df98e52eebe8ebe2c57f6434e4475df921_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:a3f9ceddc0476549ebd6486c12c78ba4ecb984664113027e1a97b15168660db8_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/clair-rhel9@sha256:e2077843bac48c84f6b5be2f102a84182a2fe33529dd84b7a2083641be6f9a29_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:be945c4a514ad0505f5443bfc4fea2b5ad8c37eaf862bc27a23a59221055fe4e_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:0a17557f786a723523b020cbcb6f028b06017a541cbce019606afb522fd89b6b_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:27414b7981b7082b4c8fac4ee33d2198c408daf171348bf6e1eb417304043484_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:868dc490afcd698634d6eed8a3e3d24bd51c72799036983c7cbd8418b7e881f5_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:aa472ac9529c09616fb003e9e1e19b439d5419175da48fed312466f45cab7cb2_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:31e87a0c686d00891488c9b3d8c42865d14de41d30002ef34656332ea23ddbfe_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3cdd404b67d28045726d5a2a111783e2035e41ad7578291400314fa28035046f_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bfcc4a075ee123df67852dc0418554fd4b7d1c5c2e267e677a5acb9b1f9c1a02_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d5959b8d429159d79083766066cfcf73c052c55165ffd0f1dd9a603a2025bbbe_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:4fab76c5abe62723f30212f352d1ad5a16039eeb807d2a25d5ba2bf6fa25f702_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:6184ea13798a9263a9201d52eeae9d33e9e45f067d67fecd61d7da920283600f_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:795eac54582c1895ee2c8de04fa444874517b37236080b2c47820b38a1af98de_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-builder-rhel9@sha256:80db7ab49837c60087228b3d4b5fa25d4d226f5ab9bf60d3e36b25baf24b31c8_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:869fcd1ccebd6c4f3a1eec8c939b82261610d903c6335541e0769ff30b571c35_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:3f032f0b0cde9e1434480c10ad4744ef6675a22167c2b0e7146235f6d990404f_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:50d052bb40fe62b16baee5506a943d24ce0db4868d79e0818d882cc5c94a3fd3_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:900b9f7e9f4ce839b8c60d787077aac160391fcda242e750d0b96f1ebbece3db_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:bd7328761976e42372fa6245fd773e1c7445444cf602919b1ece98fe5c38f15b_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-bundle@sha256:1983e925bcc375294418f29089b1e2797bc1772d712fd4de005f3c31a5746440_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:7bdfca35d58d9a3c038320a83a4b19f2217cb08513e47a6cd5a06399c21c4fda_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:819d159ab3eb7fc4d9261a1c8bad914c5c9bf7d469546ffd44e083286f480cee_ppc64le",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:9efb708dedf199d3537ddcf837d873a91ad565bc5500ac58fa346a2e0f67c995_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-operator-rhel9@sha256:a8d42b5d8d4f7a9bfb836b68764b95e0ae1df8e2fd544a8c7d63862f9b20380d_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:08a617f24b4b2b7e93b12d767b7d5eefe26e59147c90c60afb4262adfa2fe6c9_s390x",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ebc95c858f32ceda0bc0bc3517374fab58b8c37c824f9fcd361b88c6077094d_amd64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:7ee96532963603439485f596321cc47ea28e59067c76db011e53b9efa3d46f28_arm64",
            "Red Hat Quay 3.17:registry.redhat.io/quay/quay-rhel9@sha256:dd967753623a1fa4e6eb839ab7a9b910cdd2a3a20f75317f7b513829e9cca6fd_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.