RHSA-2026:5665
Vulnerability from csaf_redhat - Published: 2026-03-24 18:02 - Updated: 2026-03-27 18:09Summary
Red Hat Security Advisory: Red Hat Quay 3.10.19
Severity
Important
Notes
Topic: Red Hat Quay 3.10.19 is now available with bug fixes.
Details: Quay 3.10.19
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
7.4 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found the Pillow Python imaging library. Providing a specially crafted PSD image may lead to an out-of-bounds write. This could potentially allow for arbitrary code execution or information disclosure.
7.3 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.
7.4 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.
6.5 (Medium)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.
9.1 (Critical)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
A flaw was found in pypdf. Processing a specially crafted PDF document, specifically with circular /Prev references in the cross-reference (xref) chain, can cause an infinite loop and a high consumption of CPU, resulting in a denial of service.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).
6.5 (Medium)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
9.1 (Critical)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit this vulnerability by crafting a malicious JSON Web Token (JWT) with a "none" algorithm and an empty signature. This bypasses the expected signature verification, potentially allowing the attacker to forge tokens and gain unauthorized access or perform unauthorized actions within applications using Authlib.
9.1 (Critical)
Vendor Fix
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2026:5665
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.10.19 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.10.19",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:5665",
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25639",
"url": "https://access.redhat.com/security/cve/CVE-2026-25639"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25990",
"url": "https://access.redhat.com/security/cve/CVE-2026-25990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26007",
"url": "https://access.redhat.com/security/cve/CVE-2026-26007"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26996",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27606",
"url": "https://access.redhat.com/security/cve/CVE-2026-27606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27628",
"url": "https://access.redhat.com/security/cve/CVE-2026-27628"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27904",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28802",
"url": "https://access.redhat.com/security/cve/CVE-2026-28802"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5665.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.10.19",
"tracking": {
"current_release_date": "2026-03-27T18:09:41+00:00",
"generator": {
"date": "2026-03-27T18:09:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.4"
}
},
"id": "RHSA-2026:5665",
"initial_release_date": "2026-03-24T18:02:58+00:00",
"revision_history": [
{
"date": "2026-03-24T18:02:58+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-03-24T18:03:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-27T18:09:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.1",
"product": {
"name": "Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.10::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774022275"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021695"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774022278"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Afe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1772739218"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1772726823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Acaa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1772725047"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3Ae165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774022285"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Ade004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021722"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Ac0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1773971077"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021695"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Aba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1772726823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1772725047"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021722"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1773971077"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Aedd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021695"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1772726823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Ad59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1772725047"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774021722"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Af6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1773971077"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: Unexpected session resumption in crypto/tls",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: Unexpected session resumption in crypto/tls"
},
{
"cve": "CVE-2026-25639",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-02-09T21:00:49.280114+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438237"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25639"
},
{
"category": "external",
"summary": "RHBZ#2438237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25639"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57",
"url": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.13.5",
"url": "https://github.com/axios/axios/releases/tag/v1.13.5"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433",
"url": "https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433"
}
],
"release_date": "2026-02-09T20:11:22.374000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig"
},
{
"cve": "CVE-2026-25990",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-02-11T21:05:39.535631+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2439170"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found the Pillow Python imaging library. Providing a specially crafted PSD image may lead to an out-of-bounds write. This could potentially allow for arbitrary code execution or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25990"
},
{
"category": "external",
"summary": "RHBZ#2439170",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439170"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25990"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa",
"url": "https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"
}
],
"release_date": "2026-02-11T20:53:52.524000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image"
},
{
"cve": "CVE-2026-26007",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"discovery_date": "2026-02-10T22:01:01.036116+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438762"
}
],
"notes": [
{
"category": "description",
"text": "A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor \u003e 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it\u0027s easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26007"
},
{
"category": "external",
"summary": "RHBZ#2438762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26007"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c",
"url": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2",
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2"
}
],
"release_date": "2026-02-10T21:42:56.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
},
{
"cve": "CVE-2026-26996",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-20T04:01:11.896063+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2441268"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "RHBZ#2441268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
"url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
}
],
"release_date": "2026-02-20T03:05:21.105000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
},
{
"cve": "CVE-2026-27606",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-02-25T04:01:24.449922+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442530"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27606"
},
{
"category": "external",
"summary": "RHBZ#2442530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442530"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2",
"url": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e",
"url": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3",
"url": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v2.80.0",
"url": "https://github.com/rollup/rollup/releases/tag/v2.80.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v3.30.0",
"url": "https://github.com/rollup/rollup/releases/tag/v3.30.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v4.59.0",
"url": "https://github.com/rollup/rollup/releases/tag/v4.59.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc",
"url": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc"
}
],
"release_date": "2026-02-25T02:08:06.682000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability"
},
{
"cve": "CVE-2026-27628",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-02-25T04:02:09.864561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442543"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pypdf. Processing a specially crafted PDF document, specifically with circular /Prev references in the cross-reference (xref) chain, can cause an infinite loop and a high consumption of CPU, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to supply a crafted PDF file to be processed by an application using the pypdf library. This issue can cause the application to enter an infinite loop and consume a high amount of CPU resources, eventually resulting in a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27628"
},
{
"category": "external",
"summary": "RHBZ#2442543",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442543"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27628"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27628",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27628"
},
{
"category": "external",
"summary": "https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f",
"url": "https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f"
},
{
"category": "external",
"summary": "https://github.com/py-pdf/pypdf/issues/3654",
"url": "https://github.com/py-pdf/pypdf/issues/3654"
},
{
"category": "external",
"summary": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35",
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35"
}
],
"release_date": "2026-02-25T02:45:37.543000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams"
},
{
"cve": "CVE-2026-27904",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-26T02:01:23.004531+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442922"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "RHBZ#2442922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
}
],
"release_date": "2026-02-26T01:07:42.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-28802",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-06T07:01:49.366979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445120"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit this vulnerability by crafting a malicious JSON Web Token (JWT) with a \"none\" algorithm and an empty signature. This bypasses the expected signature verification, potentially allowing the attacker to forge tokens and gain unauthorized access or perform unauthorized actions within applications using Authlib.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28802"
},
{
"category": "external",
"summary": "RHBZ#2445120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445120"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28802"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28802",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28802"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75",
"url": "https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7",
"url": "https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg"
}
],
"release_date": "2026-03-06T06:44:26.402000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-24T18:02:58+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:5665"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:733de3a7351b69265aee8d12c7fe65f60e099c923510758a75c8800409126c41_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:caa20d6002cfd42dc4ab86dee5dde07da0a7e1dcc310c9be33bf28a2df1ef82b_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:d59935575d41174ccd39a7d7610b44d7e6afa0f56041bdefa40bc7ad4e1c837f_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:042530fcf03002da68993546ee82f483f387bd09ffe5fefaad9344b80ee842b1_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:3fb6c2af69237c3ff2cd326bc655028392a2d11c9162b85a9c4a762cbe7d044b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:4d88d159b8a0e46a8508735f555179c6b08caef62d42e5fb676fdac10e333f58_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fe1c94521b952469093c28ca9805c6758b4ac2ec6e3aa2a2001645e304949a21_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:443977ffd46161f026a30edfb8735139b7c430ca7b054b71ada75fc251226c99_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:5558d6af86f65a79c88f1ffe290b49219d0f00c93ec8a03f0e81d0e9e13501fc_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:9e96b505901615f671d5b99094bda544ecbce32a3772125f2baf5f0ea67d5687_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:ba56dd8ef744ea12e21ade86c91a9faca072e39256f98edd677a419eeae8e7a0_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:7e7559212648d972eec26d27cad42b1f93fefcc61c6ab884a730a48c81574734_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6bf4ab153aa99b67b1e3fe0cbf0fa3e3694d3394c957fc03a5578d03cb2e88bc_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:720000552d67523e437f0638abf185ae32040f1437225fc461be499490494ce7_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:edd76ba97d059e00755472146df0c84ff441c77e7cea12b9f5cd460f0c30e942_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:e165eed009ce74a4ad2de04ff1cbbcf9eabb3900bef6de3dd2483e484e9e10b3_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0731cf4122bec0cef7c4f05ee19fe43871d977515c91e0decce981abeab85af6_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0c8ad49237e784b6bcaf48c62928533a231026b1605926edee0313d3a83c10c4_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:de004a925cd7fdae3ba4698165c0a4e814607b6f33d2f7154c8d79b76c826dd7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:6e13793ca8f309ec0b69ae609b840ff0f41989d88cd4bba127e1b0040631367e_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:c0d00643c4ac6f84e5327192a29c6353b5dcac34d483d0a3e5f39d366127fcc2_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:f6a231ebb14c74e194a8091822fe6a981e1cec92d223e04e6d0f12b60206259a_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…