{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.9.22 is now available with bug fixes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.9.22",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:23361",
        "url": "https://access.redhat.com/errata/RHSA-2026:23361"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
        "url": "https://access.redhat.com/security/cve/CVE-2025-62718"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-2377",
        "url": "https://access.redhat.com/security/cve/CVE-2026-2377"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32589",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32589"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32590"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33894",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33894"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34986"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39892",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39892"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40895",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40895"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42033",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42033"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42035",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42035"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42039"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42041",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42041"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42043",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42043"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42044",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42044"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4427"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4598",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4598"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23361.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay 3.9.22",
    "tracking": {
      "current_release_date": "2026-06-05T21:04:11+00:00",
      "generator": {
        "date": "2026-06-05T21:04:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2026:23361",
      "initial_release_date": "2026-06-04T14:36:50+00:00",
      "revision_history": [
        {
          "date": "2026-06-04T14:36:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-04T14:36:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-05T21:04:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Quay 3.9",
                "product": {
                  "name": "Red Hat Quay 3.9",
                  "product_id": "Red Hat Quay 3.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3.9::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1779233745"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1779233264"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1779233747"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1779233279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1779233697"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3Add303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1779233301"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3Aff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1779233282"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256%3A8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1779815781"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3Ae89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1779233286"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Ae43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1779811473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ab20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1779233264"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1779233279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1779233301"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1779233282"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3A5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1779233286"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3A213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1779811473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
                  "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1779233264"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
                  "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1779233279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
                  "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256%3A3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1779233301"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
                  "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256%3A1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1779233282"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
                  "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256%3Ae7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1779233286"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
                "product": {
                  "name": "registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
                  "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256%3Acc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1779811473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64"
        },
        "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64 as a component of Red Hat Quay 3.9",
          "product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        },
        "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64",
        "relates_to_product_reference": "Red Hat Quay 3.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-61728",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:39.965024+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736713",
          "url": "https://go.dev/cl/736713"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77102",
          "url": "https://go.dev/issue/77102"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4342",
          "url": "https://pkg.go.dev/vuln/GO-2026-4342"
        }
      ],
      "release_date": "2026-01-28T19:30:31.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
    },
    {
      "cve": "CVE-2025-62718",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-04-09T15:01:48.111177+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456913"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456913",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
          "url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
          "url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
          "url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/pull/10661",
          "url": "https://github.com/axios/axios/pull/10661"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
        }
      ],
      "release_date": "2026-04-09T14:31:46.067000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Antony Di Scala",
            "Michael Whale"
          ]
        }
      ],
      "cve": "CVE-2026-2377",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-02-11T21:02:44.495000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2439201"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address (URL). This allows the application\u0027s backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery (SSRF). This could lead to unauthorized access to sensitive information or other internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Due to the intended and supported use case of Openshift Mirror Registry, deployment in an offline or network-isolated environment, the impact for this product has been downgraded to `Moderate`.\n\nEven in case of compromise, the blast radius is restricted to mirror-registry. It can not be escalated outside the core product. This vulnerability has been scored based on the lack of change of scope.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2377"
        },
        {
          "category": "external",
          "summary": "RHBZ#2439201",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439201"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2377",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2377"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377"
        }
      ],
      "release_date": "2026-04-08T16:18:10.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality"
    },
    {
      "cve": "CVE-2026-4427",
      "discovery_date": "2026-03-18T14:02:19.414820+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "This CVE has been marked as Rejected by the assigning CNA.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4427"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
        }
      ],
      "release_date": "2026-03-18T13:00:31+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
    },
    {
      "cve": "CVE-2026-4598",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-03-23T06:01:47.891452+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450210"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: A denial of service flaw was found in jsrsasign. This vulnerability allows a remote attacker to cause a permanent denial of service by providing specially crafted zero or negative inputs to the bnModInverse function, leading to an infinite loop. This affects Red Hat Migration Toolkit for Virtualization and Red Hat Quay, which utilize the vulnerable jsrsasign component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4598"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450210",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450210"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4598",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4598"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264",
          "url": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264"
        },
        {
          "category": "external",
          "summary": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323",
          "url": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323"
        },
        {
          "category": "external",
          "summary": "https://github.com/kjur/jsrsasign/pull/648",
          "url": "https://github.com/kjur/jsrsasign/pull/648"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938",
          "url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938"
        }
      ],
      "release_date": "2026-03-23T05:00:11.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs"
    },
    {
      "cve": "CVE-2026-32280",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:01:19.572351+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758320",
          "url": "https://go.dev/cl/758320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78282",
          "url": "https://go.dev/issue/78282"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4947",
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "release_date": "2026-04-08T01:06:58.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "cve": "CVE-2026-32281",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-04-08T02:01:00.930989+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758061",
          "url": "https://go.dev/cl/758061"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78281",
          "url": "https://go.dev/issue/78281"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4946",
          "url": "https://pkg.go.dev/vuln/GO-2026-4946"
        }
      ],
      "release_date": "2026-04-08T01:06:58.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "cve": "CVE-2026-32282",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-04-08T02:01:12.683211+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763761",
          "url": "https://go.dev/cl/763761"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78293",
          "url": "https://go.dev/issue/78293"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4864",
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "release_date": "2026-04-08T01:06:55.953000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Antony Di Scala",
            "Michael Whale"
          ]
        }
      ],
      "cve": "CVE-2026-32589",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "discovery_date": "2026-03-12T14:43:07.878000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446963"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Red Hat Quay\u0027s container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user\u0027s in-progress image upload.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mirror-registry: quay: insecure direct object reference in BlobUpload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation requires valid login credentials to the Quay registry. Unauthenticated users cannot exploit this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32589"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446963"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32589",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32589"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589"
        }
      ],
      "release_date": "2026-04-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mirror-registry: quay: insecure direct object reference in BlobUpload"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Antony Di Scala",
            "Michael Whale"
          ]
        }
      ],
      "cve": "CVE-2026-32590",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-03-12T14:43:11.443000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mirror-registry: remote code execution using pickle deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32590"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
        }
      ],
      "release_date": "2026-04-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mirror-registry: remote code execution using pickle deserialization"
    },
    {
      "cve": "CVE-2026-33894",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-03-27T21:02:52.462999+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452464"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33894"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452464",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452464"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33894",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33894"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc2313#section-8",
          "url": "https://datatracker.ietf.org/doc/html/rfc2313#section-8"
        },
        {
          "category": "external",
          "summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp",
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp"
        },
        {
          "category": "external",
          "summary": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE",
          "url": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc8017.html",
          "url": "https://www.rfc-editor.org/rfc/rfc8017.html"
        }
      ],
      "release_date": "2026-03-27T20:45:49.583000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification"
    },
    {
      "cve": "CVE-2026-34986",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-06T17:01:34.639203+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455470"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455470",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
          "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
          "url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
        }
      ],
      "release_date": "2026-04-06T16:22:45.353000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
    },
    {
      "cve": "CVE-2026-39892",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-08T22:00:59.416053+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In default configurations Red Hat products isolate service processes from total system access. Should an attacker be able to exploit this vulnerability their impact will be limited to that service account and they will not have access to the broader system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39892"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39892",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39892"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/08/12",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/08/12"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5",
          "url": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
          "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"
        }
      ],
      "release_date": "2026-04-08T20:49:41.967000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API"
    },
    {
      "cve": "CVE-2026-40192",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-04-16T00:00:49.590876+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library\u0027s failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628",
          "url": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/pull/9521",
          "url": "https://github.com/python-pillow/Pillow/pull/9521"
        },
        {
          "category": "external",
          "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j",
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"
        },
        {
          "category": "external",
          "summary": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb",
          "url": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"
        }
      ],
      "release_date": "2026-04-15T22:53:56.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing"
    },
    {
      "cve": "CVE-2026-40895",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2026-04-21T21:02:33.280553+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460297"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40895"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460297",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460297"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40895",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
        }
      ],
      "release_date": "2026-04-21T19:59:59.759000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects"
    },
    {
      "cve": "CVE-2026-42033",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T18:01:20.937507+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461607"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42033"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461607",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461607"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
        }
      ],
      "release_date": "2026-04-24T17:36:44.132000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution"
    },
    {
      "cve": "CVE-2026-42035",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T18:01:17.109481+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461606"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application\u0027s core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42035"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461606",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461606"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
        }
      ],
      "release_date": "2026-04-24T17:38:07.752000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution"
    },
    {
      "cve": "CVE-2026-42039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-24T19:01:44.887156+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461630"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461630",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
        }
      ],
      "release_date": "2026-04-24T18:01:30.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
    },
    {
      "cve": "CVE-2026-42041",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T19:01:41.034289+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461629"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42041"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461629",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
        }
      ],
      "release_date": "2026-04-24T17:55:30.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
    },
    {
      "cve": "CVE-2026-42043",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-04-24T19:01:22.552379+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461626"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: NO_PROXY bypass via crafted URL",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461626",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461626"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
        }
      ],
      "release_date": "2026-04-24T17:54:42.668000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: NO_PROXY bypass via crafted URL"
    },
    {
      "cve": "CVE-2026-42044",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T19:01:13.418725+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461624"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
          "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42044"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461624",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
        }
      ],
      "release_date": "2026-04-24T17:49:49.517000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:36:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23361"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x",
            "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
    }
  ]
}