{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat Quay 3.14.9 is now available with bug fixes.", "title": "Topic" }, { "category": "general", "text": "Quay 3.14.9", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2026:70267", "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-10143", "url": "https://access.redhat.com/security/cve/CVE-2026-10143" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-12143", "url": "https://access.redhat.com/security/cve/CVE-2026-12143" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-13149", "url": "https://access.redhat.com/security/cve/CVE-2026-13149" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-13676", "url": "https://access.redhat.com/security/cve/CVE-2026-13676" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-14257", "url": "https://access.redhat.com/security/cve/CVE-2026-14257" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-15792", "url": "https://access.redhat.com/security/cve/CVE-2026-15792" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-15927", "url": "https://access.redhat.com/security/cve/CVE-2026-15927" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-16221", "url": "https://access.redhat.com/security/cve/CVE-2026-16221" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-18255", "url": "https://access.redhat.com/security/cve/CVE-2026-18255" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-32591", "url": "https://access.redhat.com/security/cve/CVE-2026-32591" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-33747", "url": "https://access.redhat.com/security/cve/CVE-2026-33747" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-33748", "url": "https://access.redhat.com/security/cve/CVE-2026-33748" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-33818", "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39820", "url": "https://access.redhat.com/security/cve/CVE-2026-39820" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39821", "url": "https://access.redhat.com/security/cve/CVE-2026-39821" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39822", "url": "https://access.redhat.com/security/cve/CVE-2026-39822" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39828", "url": "https://access.redhat.com/security/cve/CVE-2026-39828" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39829", "url": "https://access.redhat.com/security/cve/CVE-2026-39829" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39830", "url": "https://access.redhat.com/security/cve/CVE-2026-39830" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39831", "url": "https://access.redhat.com/security/cve/CVE-2026-39831" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39832", "url": "https://access.redhat.com/security/cve/CVE-2026-39832" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-39835", "url": "https://access.redhat.com/security/cve/CVE-2026-39835" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42151", "url": "https://access.redhat.com/security/cve/CVE-2026-42151" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42154", "url": "https://access.redhat.com/security/cve/CVE-2026-42154" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42499", "url": "https://access.redhat.com/security/cve/CVE-2026-42499" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42504", "url": "https://access.redhat.com/security/cve/CVE-2026-42504" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42508", "url": "https://access.redhat.com/security/cve/CVE-2026-42508" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-4427", "url": "https://access.redhat.com/security/cve/CVE-2026-4427" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44432", "url": "https://access.redhat.com/security/cve/CVE-2026-44432" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44486", "url": "https://access.redhat.com/security/cve/CVE-2026-44486" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44487", "url": "https://access.redhat.com/security/cve/CVE-2026-44487" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44488", "url": "https://access.redhat.com/security/cve/CVE-2026-44488" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44492", "url": "https://access.redhat.com/security/cve/CVE-2026-44492" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44494", "url": "https://access.redhat.com/security/cve/CVE-2026-44494" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44495", "url": "https://access.redhat.com/security/cve/CVE-2026-44495" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44496", "url": "https://access.redhat.com/security/cve/CVE-2026-44496" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44705", "url": "https://access.redhat.com/security/cve/CVE-2026-44705" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-44990", "url": "https://access.redhat.com/security/cve/CVE-2026-44990" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-46595", "url": "https://access.redhat.com/security/cve/CVE-2026-46595" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-46597", "url": "https://access.redhat.com/security/cve/CVE-2026-46597" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-48526", "url": "https://access.redhat.com/security/cve/CVE-2026-48526" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-49477", "url": "https://access.redhat.com/security/cve/CVE-2026-49477" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-54058", "url": "https://access.redhat.com/security/cve/CVE-2026-54058" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-54060", "url": "https://access.redhat.com/security/cve/CVE-2026-54060" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-55379", "url": "https://access.redhat.com/security/cve/CVE-2026-55379" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-55380", "url": "https://access.redhat.com/security/cve/CVE-2026-55380" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-56852", "url": "https://access.redhat.com/security/cve/CVE-2026-56852" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-56853", "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-56858", "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-56859", "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-56860", "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-56862", "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-57231", "url": "https://access.redhat.com/security/cve/CVE-2026-57231" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59197", "url": "https://access.redhat.com/security/cve/CVE-2026-59197" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59199", "url": "https://access.redhat.com/security/cve/CVE-2026-59199" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59200", "url": "https://access.redhat.com/security/cve/CVE-2026-59200" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59204", "url": "https://access.redhat.com/security/cve/CVE-2026-59204" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59205", "url": "https://access.redhat.com/security/cve/CVE-2026-59205" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59869", "url": "https://access.redhat.com/security/cve/CVE-2026-59869" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59885", "url": "https://access.redhat.com/security/cve/CVE-2026-59885" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-59886", "url": "https://access.redhat.com/security/cve/CVE-2026-59886" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-6322", "url": "https://access.redhat.com/security/cve/CVE-2026-6322" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-67213", "url": "https://access.redhat.com/security/cve/CVE-2026-67213" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-67214", "url": "https://access.redhat.com/security/cve/CVE-2026-67214" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-67313", "url": "https://access.redhat.com/security/cve/CVE-2026-67313" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-67314", "url": "https://access.redhat.com/security/cve/CVE-2026-67314" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-67320", "url": "https://access.redhat.com/security/cve/CVE-2026-67320" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-67321", "url": "https://access.redhat.com/security/cve/CVE-2026-67321" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-69152", "url": "https://access.redhat.com/security/cve/CVE-2026-69152" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-69153", "url": "https://access.redhat.com/security/cve/CVE-2026-69153" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-73086", "url": "https://access.redhat.com/security/cve/CVE-2026-73086" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-73088", "url": "https://access.redhat.com/security/cve/CVE-2026-73088" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-73089", "url": "https://access.redhat.com/security/cve/CVE-2026-73089" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-84375", "url": "https://access.redhat.com/security/cve/CVE-2026-84375" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-9277", "url": "https://access.redhat.com/security/cve/CVE-2026-9277" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70267.json" } ], "title": "Red Hat Security Advisory: Red Hat Quay 3.14.9", "tracking": { "current_release_date": "2026-09-22T22:28:43+00:00", "generator": { "date": "2026-09-22T22:28:43+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.4.0" } }, "id": "RHSA-2026:70267", "initial_release_date": "2026-09-22T14:59:52+00:00", "revision_history": [ { "date": "2026-09-22T14:59:52+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-09-22T14:59:56+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-09-22T22:28:43+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Quay 3.14", "product": { "name": "Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14", "product_identification_helper": { "cpe": "cpe:/a:redhat:quay:3.14::el8" } } } ], "category": "product_family", "name": "Red Hat Quay" }, { "branches": [ { "category": "product_version", "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "product": { "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905?arch=amd64&repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle&tag=1788594785" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "product": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce?arch=amd64&repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8&tag=1788593984" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "product": { "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Af80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b?arch=amd64&repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle&tag=1788595604" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "product": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ac25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8?arch=amd64&repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8&tag=1788594258" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "product": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05?arch=amd64&repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8&tag=1788594388" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "product": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-builder-rhel8@sha256%3A73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551?arch=amd64&repository_url=registry.redhat.io/quay/quay-builder-rhel8&tag=1788593707" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "product": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "product_identification_helper": { "purl": "pkg:oci/clair-rhel8@sha256%3Af668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a?arch=amd64&repository_url=registry.redhat.io/quay/clair-rhel8&tag=1788593782" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "product": { "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-operator-bundle@sha256%3A5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686?arch=amd64&repository_url=registry.redhat.io/quay/quay-operator-bundle&tag=1788598271" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "product": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-operator-rhel8@sha256%3Aa4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3?arch=amd64&repository_url=registry.redhat.io/quay/quay-operator-rhel8&tag=1788593658" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "product": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "product_identification_helper": { "purl": "pkg:oci/quay-rhel8@sha256%3A7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af?arch=amd64&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1788593843" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "product": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785?arch=arm64&repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8&tag=1788593984" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "product": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b?arch=arm64&repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8&tag=1788594258" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "product": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "product_identification_helper": { "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c?arch=arm64&repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8&tag=1788594388" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "product": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "product_identification_helper": { "purl": "pkg:oci/quay-builder-rhel8@sha256%3Ad8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8?arch=arm64&repository_url=registry.redhat.io/quay/quay-builder-rhel8&tag=1788593707" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "product": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "product_identification_helper": { "purl": "pkg:oci/clair-rhel8@sha256%3A1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138?arch=arm64&repository_url=registry.redhat.io/quay/clair-rhel8&tag=1788593782" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "product": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "product_identification_helper": { "purl": "pkg:oci/quay-operator-rhel8@sha256%3A868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da?arch=arm64&repository_url=registry.redhat.io/quay/quay-operator-rhel8&tag=1788593658" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "product": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "product_identification_helper": { "purl": "pkg:oci/quay-rhel8@sha256%3A7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa?arch=arm64&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1788593843" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "product": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c?arch=ppc64le&repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8&tag=1788593984" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "product": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e?arch=ppc64le&repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8&tag=1788594258" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "product": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "product_identification_helper": { "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Ac53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc?arch=ppc64le&repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8&tag=1788594388" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "product": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "product_identification_helper": { "purl": "pkg:oci/quay-builder-rhel8@sha256%3Afe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a?arch=ppc64le&repository_url=registry.redhat.io/quay/quay-builder-rhel8&tag=1788593707" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "product": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "product_identification_helper": { "purl": "pkg:oci/clair-rhel8@sha256%3A242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50?arch=ppc64le&repository_url=registry.redhat.io/quay/clair-rhel8&tag=1788593782" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "product": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "product_identification_helper": { "purl": "pkg:oci/quay-operator-rhel8@sha256%3A360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5?arch=ppc64le&repository_url=registry.redhat.io/quay/quay-operator-rhel8&tag=1788593658" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le", "product": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le", "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le", "product_identification_helper": { "purl": "pkg:oci/quay-rhel8@sha256%3A9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6?arch=ppc64le&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1788593843" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "product": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "product_identification_helper": { "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ad11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725?arch=s390x&repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8&tag=1788593984" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "product": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "product_identification_helper": { "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360?arch=s390x&repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8&tag=1788594258" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "product": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "product_identification_helper": { "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Aac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3?arch=s390x&repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8&tag=1788594388" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "product": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "product_identification_helper": { "purl": "pkg:oci/quay-builder-rhel8@sha256%3A90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af?arch=s390x&repository_url=registry.redhat.io/quay/quay-builder-rhel8&tag=1788593707" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "product": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "product_id": "registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "product_identification_helper": { "purl": "pkg:oci/clair-rhel8@sha256%3A1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0?arch=s390x&repository_url=registry.redhat.io/quay/clair-rhel8&tag=1788593782" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "product": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "product_identification_helper": { "purl": "pkg:oci/quay-operator-rhel8@sha256%3A5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80?arch=s390x&repository_url=registry.redhat.io/quay/quay-operator-rhel8&tag=1788593658" } } }, { "category": "product_version", "name": "registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "product": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "product_id": "registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "product_identification_helper": { "purl": "pkg:oci/quay-rhel8@sha256%3A5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd?arch=s390x&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1788593843" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x" }, "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64" }, "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le" }, "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64" }, "product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64" }, "product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64" }, "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le" }, "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x" }, "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64" }, "product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64" }, "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64" }, "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x" }, "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le" }, "product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64" }, "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x" }, "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64" }, "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le" }, "product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64" }, "product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64" }, "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le" }, "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64" }, "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x" }, "product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64" }, "product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le" }, "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x" }, "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64" }, "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" }, "product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x" }, "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64" }, "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64 as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64" }, "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "relates_to_product_reference": "Red Hat Quay 3.14" }, { "category": "default_component_of", "full_product_name": { "name": "registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le as a component of Red Hat Quay 3.14", "product_id": "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" }, "product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le", "relates_to_product_reference": "Red Hat Quay 3.14" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-4427", "discovery_date": "2026-03-18T14:02:19.414820+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "notes": [ { "category": "description", "text": "No description is available for this CVE.", "title": "Vulnerability description" }, { "category": "other", "text": "This CVE has been marked as Rejected by the assigning CNA.", "title": "Statement" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-4427" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4427" } ], "release_date": "2026-03-18T13:00:31+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message" }, { "cve": "CVE-2026-6322", "cwe": { "id": "CWE-140", "name": "Improper Neutralization of Delimiters" }, "discovery_date": "2026-05-05T11:01:00.332189+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2466684" } ], "notes": [ { "category": "description", "text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI's intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.", "title": "Vulnerability description" }, { "category": "summary", "text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important flaw in the `fast-uri` library allows an attacker to bypass security controls in Red Hat products that process Uniform Resource Identifiers (URIs). By crafting a malicious URI with percent-encoded authority delimiters, an attacker can cause the library to incorrectly interpret the URI's authority, potentially redirecting applications to an unintended domain. This could lead to a bypass of host allowlist checks, redirect validation, or outbound request routing.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-6322" }, { "category": "external", "summary": "RHBZ#2466684", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466684" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6322", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6322" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322" }, { "category": "external", "summary": "https://cna.openjsf.org/security-advisories.html", "url": "https://cna.openjsf.org/security-advisories.html" }, { "category": "external", "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc", "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc" } ], "release_date": "2026-05-05T10:29:16.378000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling" }, { "cve": "CVE-2026-9277", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "discovery_date": "2026-05-22T14:01:14.427751+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480741" } ], "notes": [ { "category": "description", "text": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.", "title": "Vulnerability description" }, { "category": "summary", "text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-9277" }, { "category": "external", "summary": "RHBZ#2480741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9277", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9277" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277" }, { "category": "external", "summary": "https://github.com/ljharb/shell-quote", "url": "https://github.com/ljharb/shell-quote" }, { "category": "external", "summary": "https://github.com/ljharb/shell-quote/commit/1518179", "url": "https://github.com/ljharb/shell-quote/commit/1518179" }, { "category": "external", "summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p", "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p" }, { "category": "external", "summary": "https://www.npmjs.com/package/shell-quote", "url": "https://www.npmjs.com/package/shell-quote" } ], "release_date": "2026-05-22T13:22:38.873000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators" }, { "cve": "CVE-2026-10143", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "discovery_date": "2026-06-10T21:02:14.712750+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487722" } ], "notes": [ { "category": "description", "text": "A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client's event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.", "title": "Vulnerability description" }, { "category": "summary", "text": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-10143" }, { "category": "external", "summary": "RHBZ#2487722", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487722" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10143", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143" }, { "category": "external", "summary": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b", "url": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b" }, { "category": "external", "summary": "https://github.com/dpkp/kafka-python/pull/3019", "url": "https://github.com/dpkp/kafka-python/pull/3019" }, { "category": "external", "summary": "https://github.com/dpkp/kafka-python/pull/3026", "url": "https://github.com/dpkp/kafka-python/pull/3026" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py", "url": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py" } ], "release_date": "2026-06-10T20:22:39.262000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count" }, { "cve": "CVE-2026-12143", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "discovery_date": "2026-06-12T19:00:57.360953+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2488480" } ], "notes": [ { "category": "description", "text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "form-data: form-data: Form field override via CRLF injection", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-12143" }, { "category": "external", "summary": "RHBZ#2488480", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143" }, { "category": "external", "summary": "https://cwe.mitre.org/data/definitions/93.html", "url": "https://cwe.mitre.org/data/definitions/93.html" }, { "category": "external", "summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435", "url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435" }, { "category": "external", "summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229", "url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229" }, { "category": "external", "summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045", "url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045" }, { "category": "external", "summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx", "url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx" }, { "category": "external", "summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data" }, { "category": "external", "summary": "https://www.npmjs.com/package/form-data", "url": "https://www.npmjs.com/package/form-data" } ], "release_date": "2026-06-12T18:01:30.362000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "form-data: form-data: Form field override via CRLF injection" }, { "cve": "CVE-2026-13149", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2026-06-30T10:00:59.843854+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2494813" } ], "notes": [ { "category": "description", "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-13149" }, { "category": "external", "summary": "RHBZ#2494813", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754" }, { "category": "external", "summary": "https://www.npmjs.com/package/brace-expansion", "url": "https://www.npmjs.com/package/brace-expansion" } ], "release_date": "2026-06-30T08:30:34.502000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity" }, { "cve": "CVE-2026-13676", "cwe": { "id": "CWE-551", "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization" }, "discovery_date": "2026-06-29T14:01:55.592330+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2494197" } ], "notes": [ { "category": "description", "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.", "title": "Vulnerability description" }, { "category": "summary", "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-13676" }, { "category": "external", "summary": "RHBZ#2494197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676" }, { "category": "external", "summary": "https://cna.openjsf.org/security-advisories.html", "url": "https://cna.openjsf.org/security-advisories.html" }, { "category": "external", "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6", "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6" } ], "release_date": "2026-06-29T13:22:44.674000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization" }, { "cve": "CVE-2026-14257", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-07-23T14:01:26.376839+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2506433" } ], "notes": [ { "category": "description", "text": "A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.", "title": "Vulnerability description" }, { "category": "summary", "text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.\n\nNote: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.\n\n```\n$ npm ls --omit=dev brace-expansion\nnpm@10.9.8 /usr/lib/node_modules/npm\n`-- minimatch@9.0.9\n `-- brace-expansion@2.0.2\n```", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-14257" }, { "category": "external", "summary": "RHBZ#2506433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14257", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14257" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion", "url": "https://github.com/juliangruber/brace-expansion" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5" }, { "category": "external", "summary": "https://www.npmjs.com/package/brace-expansion", "url": "https://www.npmjs.com/package/brace-expansion" } ], "release_date": "2026-07-23T12:54:23.124000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Do not pass untrusted or user-controlled input to brace-expansion's expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.\n\nWhere possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.\n\nAs an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function" }, { "cve": "CVE-2026-15792", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "discovery_date": "2026-07-21T17:01:51.555730+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2503746" } ], "notes": [ { "category": "description", "text": "A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service (DoS), making the BuildKit service unavailable.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request", "title": "Vulnerability summary" }, { "category": "other", "text": "BuildKit is used by several Red Hat products to build container images. This issue allows a malicious BuildKit frontend or client to cause the BuildKit build process to crash. Exploiting this issue requires the ability to supply a build definition (for example, a Dockerfile specifying a custom #syntax frontend) to a BuildKit-based build; it does not allow remote code execution or exposure of data. The issue is fixed upstream in BuildKit version 0.31.2. Red Hat Hardened Images (Buildah, Podman, and Trivy) has already shipped the fixed version. Other affected Red Hat products are being assessed and will ship the fixed version of BuildKit in upcoming releases.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-15792" }, { "category": "external", "summary": "RHBZ#2503746", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503746" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15792", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15792" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15792", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15792" }, { "category": "external", "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6" } ], "release_date": "2026-07-21T16:10:21.395000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Avoid building container images using BuildKit frontends from untrusted sources. A BuildKit frontend is typically specified using a \"# syntax\" directive at the top of a Dockerfile, or with the \"--frontend\" option to the \"buildctl build\" command. Only use frontend images that come from a trusted source.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request" }, { "acknowledgments": [ { "names": [ "Shaon Hossain" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." }, { "names": [ "Martin Brodeur" ] } ], "cve": "CVE-2026-15927", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2026-02-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2501256" } ], "notes": [ { "category": "description", "text": "A flaw was found in Red Hat Quay's repository-level mirror configuration\nfeature. The POST and PUT handlers in endpoints/api/mirror.py accept an\nexternal_reference parameter without SSRF validation, unlike the\norganization-level mirror handlers which apply validate_external_registry_url().\nA repository administrator can supply a crafted hostname that causes the Quay\nmirror worker to make requests via Skopeo to internal network services, cloud\nmetadata endpoints, or other resources not intended to be reachable from the\nQuay application.", "title": "Vulnerability description" }, { "category": "summary", "text": "quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important flaw in Red Hat Quay's repository-level mirror configuration allows an authenticated repository administrator to conduct Server-Side Request Forgery (SSRF). By providing a specially crafted hostname, an attacker can force the Quay mirror worker to connect to internal network services or cloud metadata endpoints, potentially exposing sensitive internal resources. This risk is limited to actions performed by an authenticated administrator.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-15927" }, { "category": "external", "summary": "RHBZ#2501256", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501256" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15927", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15927" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15927", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15927" } ], "release_date": "2026-07-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Restrict network egress from Quay mirror worker pods/containers using network\npolicies or firewall rules to block access to internal network ranges\n(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints\n(169.254.169.254, metadata.google.internal). Limit repository creation and\nadmin privileges to trusted users via Quay's RBAC configuration. If\nrepository-level mirroring is not required, disable the feature or restrict\naccess to the mirror API endpoints through a reverse proxy.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation" }, { "cve": "CVE-2026-16221", "cwe": { "id": "CWE-807", "name": "Reliance on Untrusted Inputs in a Security Decision" }, "discovery_date": "2026-07-19T15:02:40.167601+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2502307" } ], "notes": [ { "category": "description", "text": "A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.", "title": "Vulnerability description" }, { "category": "summary", "text": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: This flaw in fast-uri allows for a security policy bypass due to inconsistent URL parsing between fast-uri and Node.js's native WHATWG URL parser. Applications within Red Hat Hardened Images that rely on fast-uri for host-based policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, can be misled by specially crafted URLs. This could enable an attacker to redirect traffic to unintended internal or sensitive network destinations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-16221" }, { "category": "external", "summary": "RHBZ#2502307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502307" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16221", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16221" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16221" }, { "category": "external", "summary": "https://cna.openjsf.org/security-advisories.html", "url": "https://cna.openjsf.org/security-advisories.html" }, { "category": "external", "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx", "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx" } ], "release_date": "2026-07-19T14:08:32.993000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency" }, { "cve": "CVE-2026-18255", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2026-07-21T14:34:20+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2508454" } ], "notes": [ { "category": "description", "text": "A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.", "title": "Vulnerability description" }, { "category": "summary", "text": "quay: quay: Global read-only superuser can view robot account tokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-18255" }, { "category": "external", "summary": "RHBZ#2508454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18255", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18255" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18255", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18255" } ], "release_date": "2026-07-21T14:34:20+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "quay: quay: Global read-only superuser can view robot account tokens" }, { "acknowledgments": [ { "names": [ "Antony Di Scala", "Michael Whale" ] } ], "cve": "CVE-2026-32591", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2026-03-12T15:09:38.210000+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2446965" } ], "notes": [ { "category": "description", "text": "A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.", "title": "Vulnerability description" }, { "category": "summary", "text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration", "title": "Vulnerability summary" }, { "category": "other", "text": "Exploitation requires the attacker to be authenticated as an organization administrator.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-32591" }, { "category": "external", "summary": "RHBZ#2446965", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32591" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591" } ], "release_date": "2026-04-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration" }, { "cve": "CVE-2026-33747", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-03-27T02:01:29.921765+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2452076" } ], "notes": [ { "category": "description", "text": "A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.", "title": "Vulnerability description" }, { "category": "summary", "text": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-33747" }, { "category": "external", "summary": "RHBZ#2452076", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452076" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33747", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33747" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747" }, { "category": "external", "summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1", "url": "https://github.com/moby/buildkit/releases/tag/v0.28.1" }, { "category": "external", "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj" } ], "release_date": "2026-03-27T00:49:06.165000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend" }, { "cve": "CVE-2026-33748", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-03-27T15:02:00.107493+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2452271" } ], "notes": [ { "category": "description", "text": "A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-33748" }, { "category": "external", "summary": "RHBZ#2452271", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452271" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33748", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33748" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748" }, { "category": "external", "summary": "https://docs.docker.com/build/concepts/context/#url-fragments", "url": "https://docs.docker.com/build/concepts/context/#url-fragments" }, { "category": "external", "summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1", "url": "https://github.com/moby/buildkit/releases/tag/v0.28.1" }, { "category": "external", "summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg" } ], "release_date": "2026-03-27T14:00:21.200000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components" }, { "cve": "CVE-2026-33818", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')" }, "discovery_date": "2026-08-13T22:12:37.151735+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515815" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "category": "external", "summary": "RHBZ#2515815", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818" }, { "category": "external", "summary": "https://go.dev/cl/814980", "url": "https://go.dev/cl/814980" }, { "category": "external", "summary": "https://go.dev/issue/80405", "url": "https://go.dev/issue/80405" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5972", "url": "https://pkg.go.dev/vuln/GO-2026-5972" } ], "release_date": "2026-08-13T21:58:52.821000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal" }, { "cve": "CVE-2026-39820", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "discovery_date": "2026-05-07T20:01:27.800929+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2467820" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39820" }, { "category": "external", "summary": "RHBZ#2467820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820" }, { "category": "external", "summary": "https://go.dev/cl/759940", "url": "https://go.dev/cl/759940" }, { "category": "external", "summary": "https://go.dev/issue/78566", "url": "https://go.dev/issue/78566" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4986", "url": "https://pkg.go.dev/vuln/GO-2026-4986" } ], "release_date": "2026-05-07T19:41:19.854000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs" }, { "cve": "CVE-2026-39821", "cwe": { "id": "CWE-1289", "name": "Improper Validation of Unsafe Equivalence in Input" }, "discovery_date": "2026-05-22T16:00:52.844126+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480756" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "title": "Vulnerability summary" }, { "category": "other", "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39821" }, { "category": "external", "summary": "RHBZ#2480756", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821" }, { "category": "external", "summary": "https://go.dev/cl/767220", "url": "https://go.dev/cl/767220" }, { "category": "external", "summary": "https://go.dev/issue/78760", "url": "https://go.dev/issue/78760" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5026", "url": "https://pkg.go.dev/vuln/GO-2026-5026" } ], "release_date": "2026-05-22T15:01:21.462000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing" }, { "cve": "CVE-2026-39822", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "discovery_date": "2026-07-08T17:01:53.592869+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2498152" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in Go's os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39822" }, { "category": "external", "summary": "RHBZ#2498152", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822" }, { "category": "external", "summary": "https://go.dev/cl/797880", "url": "https://go.dev/cl/797880" }, { "category": "external", "summary": "https://go.dev/issue/79005", "url": "https://go.dev/issue/79005" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4970", "url": "https://pkg.go.dev/vuln/GO-2026-4970" } ], "release_date": "2026-07-08T15:46:27.199000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal" }, { "cve": "CVE-2026-39828", "cwe": { "id": "CWE-281", "name": "Improper Preservation of Permissions" }, "discovery_date": "2026-05-22T04:01:46.775641+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480687" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39828" }, { "category": "external", "summary": "RHBZ#2480687", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39828" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828" }, { "category": "external", "summary": "https://go.dev/cl/781621", "url": "https://go.dev/cl/781621" }, { "category": "external", "summary": "https://go.dev/issue/79562", "url": "https://go.dev/issue/79562" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5014", "url": "https://pkg.go.dev/vuln/GO-2026-5014" } ], "release_date": "2026-05-22T02:31:26.883000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions" }, { "cve": "CVE-2026-39829", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "discovery_date": "2026-05-22T04:01:30.092249+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480681" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39829" }, { "category": "external", "summary": "RHBZ#2480681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39829" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829" }, { "category": "external", "summary": "https://go.dev/cl/781641", "url": "https://go.dev/cl/781641" }, { "category": "external", "summary": "https://go.dev/cl/781661", "url": "https://go.dev/cl/781661" }, { "category": "external", "summary": "https://go.dev/issue/79565", "url": "https://go.dev/issue/79565" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5018", "url": "https://pkg.go.dev/vuln/GO-2026-5018" } ], "release_date": "2026-05-22T02:31:27.324000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters" }, { "cve": "CVE-2026-39830", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "discovery_date": "2026-05-22T04:01:38.517202+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480684" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39830" }, { "category": "external", "summary": "RHBZ#2480684", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39830" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830" }, { "category": "external", "summary": "https://go.dev/cl/781640", "url": "https://go.dev/cl/781640" }, { "category": "external", "summary": "https://go.dev/cl/781664", "url": "https://go.dev/cl/781664" }, { "category": "external", "summary": "https://go.dev/issue/79564", "url": "https://go.dev/issue/79564" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5017", "url": "https://pkg.go.dev/vuln/GO-2026-5017" } ], "release_date": "2026-05-22T02:31:27.208000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses" }, { "cve": "CVE-2026-39831", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "discovery_date": "2026-05-22T04:01:12.861178+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480675" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39831" }, { "category": "external", "summary": "RHBZ#2480675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39831" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831" }, { "category": "external", "summary": "https://go.dev/cl/781662", "url": "https://go.dev/cl/781662" }, { "category": "external", "summary": "https://go.dev/issue/79566", "url": "https://go.dev/issue/79566" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5019", "url": "https://pkg.go.dev/vuln/GO-2026-5019" } ], "release_date": "2026-05-22T02:31:27.436000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check" }, { "cve": "CVE-2026-39832", "cwe": { "id": "CWE-281", "name": "Improper Preservation of Permissions" }, "discovery_date": "2026-05-22T04:01:41.402561+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480685" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39832" }, { "category": "external", "summary": "RHBZ#2480685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39832" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832" }, { "category": "external", "summary": "https://go.dev/cl/778642", "url": "https://go.dev/cl/778642" }, { "category": "external", "summary": "https://go.dev/issue/79435", "url": "https://go.dev/issue/79435" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5006", "url": "https://pkg.go.dev/vuln/GO-2026-5006" } ], "release_date": "2026-05-22T02:31:26.660000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions" }, { "cve": "CVE-2026-39835", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2026-05-22T04:01:27.279943+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480680" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-39835" }, { "category": "external", "summary": "RHBZ#2480680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39835" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835" }, { "category": "external", "summary": "https://go.dev/cl/781660", "url": "https://go.dev/cl/781660" }, { "category": "external", "summary": "https://go.dev/issue/79563", "url": "https://go.dev/issue/79563" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5015", "url": "https://pkg.go.dev/vuln/GO-2026-5015" } ], "release_date": "2026-05-22T02:31:26.982000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate" }, { "cve": "CVE-2026-42151", "cwe": { "id": "CWE-256", "name": "Plaintext Storage of a Password" }, "discovery_date": "2026-05-04T19:02:26.983660+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2466507" } ], "notes": [ { "category": "description", "text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42151" }, { "category": "external", "summary": "RHBZ#2466507", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42151" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/pull/18587", "url": "https://github.com/prometheus/prometheus/pull/18587" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/pull/18590", "url": "https://github.com/prometheus/prometheus/pull/18590" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3", "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3", "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj", "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj" } ], "release_date": "2026-05-04T18:12:16.917000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API" }, { "cve": "CVE-2026-42154", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-05-04T19:02:19.626646+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2466505" } ], "notes": [ { "category": "description", "text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42154" }, { "category": "external", "summary": "RHBZ#2466505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42154" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/pull/18584", "url": "https://github.com/prometheus/prometheus/pull/18584" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/pull/18585", "url": "https://github.com/prometheus/prometheus/pull/18585" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3", "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3", "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3" }, { "category": "external", "summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm", "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm" } ], "release_date": "2026-05-04T18:13:12.340000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint" }, { "cve": "CVE-2026-42499", "cwe": { "id": "CWE-1046", "name": "Creation of Immutable Text Using String Concatenation" }, "discovery_date": "2026-05-07T20:00:51.685602+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2467809" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42499" }, { "category": "external", "summary": "RHBZ#2467809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499" }, { "category": "external", "summary": "https://go.dev/cl/771520", "url": "https://go.dev/cl/771520" }, { "category": "external", "summary": "https://go.dev/issue/78987", "url": "https://go.dev/issue/78987" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4977", "url": "https://pkg.go.dev/vuln/GO-2026-4977" } ], "release_date": "2026-05-07T19:41:18.615000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing" }, { "cve": "CVE-2026-42504", "cwe": { "id": "CWE-1050", "name": "Excessive Platform Resource Consumption within a Loop" }, "discovery_date": "2026-06-02T23:01:00.320527+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2484204" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "title": "Vulnerability summary" }, { "category": "other", "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42504" }, { "category": "external", "summary": "RHBZ#2484204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504" }, { "category": "external", "summary": "https://go.dev/cl/774481", "url": "https://go.dev/cl/774481" }, { "category": "external", "summary": "https://go.dev/issue/79217", "url": "https://go.dev/issue/79217" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5038", "url": "https://pkg.go.dev/vuln/GO-2026-5038" } ], "release_date": "2026-06-02T22:01:37.219000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header" }, { "cve": "CVE-2026-42508", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2026-05-22T04:01:49.515058+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480688" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42508" }, { "category": "external", "summary": "RHBZ#2480688", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42508" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508" }, { "category": "external", "summary": "https://go.dev/cl/781220", "url": "https://go.dev/cl/781220" }, { "category": "external", "summary": "https://go.dev/issue/79568", "url": "https://go.dev/issue/79568" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5021", "url": "https://pkg.go.dev/vuln/GO-2026-5021" } ], "release_date": "2026-05-22T02:31:27.644000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey" }, { "cve": "CVE-2026-44432", "cwe": { "id": "CWE-409", "name": "Improper Handling of Highly Compressed Data (Data Amplification)" }, "discovery_date": "2026-05-13T17:01:01.083841+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2477154" } ], "notes": [ { "category": "description", "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44432" }, { "category": "external", "summary": "RHBZ#2477154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432" }, { "category": "external", "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j", "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j" } ], "release_date": "2026-05-13T15:17:12.611000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression" }, { "cve": "CVE-2026-44486", "cwe": { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data" }, "discovery_date": "2026-06-11T17:01:30.944384+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487947" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44486" }, { "category": "external", "summary": "RHBZ#2487947", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44486" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc", "url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc" } ], "release_date": "2026-06-11T15:39:07.714000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects" }, { "cve": "CVE-2026-44487", "cwe": { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data" }, "discovery_date": "2026-06-11T17:01:34.091476+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487948" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Information disclosure of proxy credentials via redirect flows", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44487" }, { "category": "external", "summary": "RHBZ#2487948", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v", "url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v" } ], "release_date": "2026-06-11T15:38:25.150000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Information disclosure of proxy credentials via redirect flows" }, { "cve": "CVE-2026-44488", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-06-11T17:01:36.836488+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487949" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Denial of Service due to unenforced request and response size limits", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44488" }, { "category": "external", "summary": "RHBZ#2487949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44488" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf", "url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf" } ], "release_date": "2026-06-11T15:37:38.013000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Denial of Service due to unenforced request and response size limits" }, { "cve": "CVE-2026-44492", "cwe": { "id": "CWE-289", "name": "Authentication Bypass by Alternate Name" }, "discovery_date": "2026-06-11T17:00:56.761751+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487938" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44492" }, { "category": "external", "summary": "RHBZ#2487938", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv", "url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv" } ], "release_date": "2026-06-11T15:29:13.890000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization" }, { "cve": "CVE-2026-44494", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2026-06-11T17:01:12.945664+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487942" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application's dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44494" }, { "category": "external", "summary": "RHBZ#2487942", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44494" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh", "url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh" } ], "release_date": "2026-06-11T15:32:03.155000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution" }, { "cve": "CVE-2026-44495", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2026-06-11T17:00:53.999811+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487937" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Information disclosure due to prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important vulnerability in Axios, a promise-based HTTP client, can lead to information disclosure, including credential theft and response hijacking, or denial of service. Exploitation requires a separate prototype pollution vulnerability in the same JavaScript process, allowing an attacker to control `Object.prototype.transformResponse`. Red Hat products using affected Axios versions are at risk if another component introduces such pollution.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44495" }, { "category": "external", "summary": "RHBZ#2487937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487937" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44495", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44495" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw", "url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw" } ], "release_date": "2026-06-11T15:33:12.433000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Information disclosure due to prototype pollution vulnerability" }, { "cve": "CVE-2026-44496", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2026-06-11T17:01:15.856386+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487943" } ], "notes": [ { "category": "description", "text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44496" }, { "category": "external", "summary": "RHBZ#2487943", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44496" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf", "url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf" } ], "release_date": "2026-06-11T15:34:28.492000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name" }, { "cve": "CVE-2026-44705", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-06-11T17:01:27.295887+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487946" } ], "notes": [ { "category": "description", "text": "A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.", "title": "Vulnerability description" }, { "category": "summary", "text": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape", "title": "Vulnerability summary" }, { "category": "other", "text": "Applications that pass user-controlled data to the file or directory creation functions without input sanitization are vulnerable to this issue. This flaw allows files to be created in arbitrary locations with the privileges of the running process. Due to this reason, this vulnerability has been rated with an Important severity.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44705" }, { "category": "external", "summary": "RHBZ#2487946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487946" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44705", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44705" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44705" }, { "category": "external", "summary": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65", "url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65" } ], "release_date": "2026-06-11T15:42:46.565000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "tmp: path Traversal via unsanitized prefix/postfix enables directory escape" }, { "cve": "CVE-2026-44990", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-06-12T21:02:24.911971+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2488565" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.", "title": "Vulnerability description" }, { "category": "summary", "text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44990" }, { "category": "external", "summary": "RHBZ#2488565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44990" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990" }, { "category": "external", "summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643", "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643" } ], "release_date": "2026-06-12T20:39:47.065000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass" }, { "cve": "CVE-2026-46595", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2026-05-22T04:01:52.215134+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480689" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "title": "Vulnerability summary" }, { "category": "other", "text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-46595" }, { "category": "external", "summary": "RHBZ#2480689", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46595" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595" }, { "category": "external", "summary": "https://go.dev/cl/781642", "url": "https://go.dev/cl/781642" }, { "category": "external", "summary": "https://go.dev/issue/79570", "url": "https://go.dev/issue/79570" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5023", "url": "https://pkg.go.dev/vuln/GO-2026-5023" } ], "release_date": "2026-05-22T02:31:27.894000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation" }, { "cve": "CVE-2026-46597", "cwe": { "id": "CWE-681", "name": "Incorrect Conversion between Numeric Types" }, "discovery_date": "2026-05-22T04:01:21.721980+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2480678" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-46597" }, { "category": "external", "summary": "RHBZ#2480678", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46597" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597" }, { "category": "external", "summary": "https://go.dev/cl/781620", "url": "https://go.dev/cl/781620" }, { "category": "external", "summary": "https://go.dev/issue/79561", "url": "https://go.dev/issue/79561" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5013", "url": "https://pkg.go.dev/vuln/GO-2026-5013" } ], "release_date": "2026-05-22T02:31:26.754000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs" }, { "cve": "CVE-2026-48526", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "discovery_date": "2026-05-28T16:01:22.805235+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2482734" } ], "notes": [ { "category": "description", "text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-48526" }, { "category": "external", "summary": "RHBZ#2482734", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48526" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526" }, { "category": "external", "summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx", "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx" } ], "release_date": "2026-05-28T15:09:09.258000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens" }, { "cve": "CVE-2026-49477", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2026-07-14T22:04:22.677547+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500752" } ], "notes": [ { "category": "description", "text": "A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.", "title": "Vulnerability description" }, { "category": "summary", "text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-49477" }, { "category": "external", "summary": "RHBZ#2500752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500752" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49477", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49477" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49477" }, { "category": "external", "summary": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3", "url": "https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3" }, { "category": "external", "summary": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4", "url": "https://github.com/facelessuser/soupsieve/releases/tag/2.8.4" }, { "category": "external", "summary": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37", "url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37" } ], "release_date": "2026-07-14T20:51:29.369000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings" }, { "cve": "CVE-2026-54058", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2026-07-14T17:02:34.864708+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500057" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.", "title": "Vulnerability description" }, { "category": "summary", "text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image", "title": "Vulnerability summary" }, { "category": "other", "text": "Pillow is vulnerable to an out-of-bounds read when processing a crafted uncompressed McIdas AREA image via the mmap raw codec. A remote attacker who can supply such an image to a service that loads it without user interaction may disclose adjacent process memory or trigger a denial of service. Fixed in Pillow 12.3.0.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-54058" }, { "category": "external", "summary": "RHBZ#2500057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54058", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54058" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54058", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54058" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d", "url": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/pull/9719", "url": "https://github.com/python-pillow/Pillow/pull/9719" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93" } ], "release_date": "2026-07-14T16:27:38.050000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image" }, { "cve": "CVE-2026-54060", "cwe": { "id": "CWE-1050", "name": "Excessive Platform Resource Consumption within a Loop" }, "discovery_date": "2026-07-06T20:02:29.509113+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2497466" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-54060" }, { "category": "external", "summary": "RHBZ#2497466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54060" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2" } ], "release_date": "2026-07-06T18:49:23.788000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files" }, { "cve": "CVE-2026-55379", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-07-06T20:01:29.922515+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2497452" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Pillow: Denial of Service via crafted BDF font file", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-55379" }, { "category": "external", "summary": "RHBZ#2497452", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc" } ], "release_date": "2026-07-06T18:52:11.633000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "python-pillow: Pillow: Denial of Service via crafted BDF font file" }, { "cve": "CVE-2026-55380", "cwe": { "id": "CWE-1285", "name": "Improper Validation of Specified Index, Position, or Offset in Input" }, "discovery_date": "2026-07-06T20:01:42.245051+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2497455" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file", "title": "Vulnerability summary" }, { "category": "other", "text": "A denial-of-service vulnerability was found in Pillow's GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-55380" }, { "category": "external", "summary": "RHBZ#2497455", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55380" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675", "url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm" } ], "release_date": "2026-07-06T18:50:14.789000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file" }, { "cve": "CVE-2026-56852", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "discovery_date": "2026-07-21T20:01:56.266823+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2504233" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56852" }, { "category": "external", "summary": "RHBZ#2504233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852" }, { "category": "external", "summary": "https://go.dev/cl/794100", "url": "https://go.dev/cl/794100" }, { "category": "external", "summary": "https://go.dev/issue/80142", "url": "https://go.dev/issue/80142" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5970", "url": "https://pkg.go.dev/vuln/GO-2026-5970" } ], "release_date": "2026-07-21T19:18:59.951000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input" }, { "cve": "CVE-2026-56853", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-13T22:14:53.561638+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515827" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "category": "external", "summary": "RHBZ#2515827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853" }, { "category": "external", "summary": "https://go.dev/cl/795540", "url": "https://go.dev/cl/795540" }, { "category": "external", "summary": "https://go.dev/issue/80205", "url": "https://go.dev/issue/80205" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6089", "url": "https://pkg.go.dev/vuln/GO-2026-6089" } ], "release_date": "2026-08-13T21:58:53.092000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service" }, { "cve": "CVE-2026-56858", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-08-13T22:16:32.034590+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515838" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.", "title": "Vulnerability description" }, { "category": "summary", "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "category": "external", "summary": "RHBZ#2515838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858" }, { "category": "external", "summary": "https://go.dev/cl/807100", "url": "https://go.dev/cl/807100" }, { "category": "external", "summary": "https://go.dev/issue/80435", "url": "https://go.dev/issue/80435" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6091", "url": "https://pkg.go.dev/vuln/GO-2026-6091" } ], "release_date": "2026-08-13T21:58:53.354000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input" }, { "cve": "CVE-2026-56859", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')" }, "discovery_date": "2026-08-13T22:16:52.493058+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515840" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.", "title": "Vulnerability description" }, { "category": "summary", "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "title": "Vulnerability summary" }, { "category": "other", "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "category": "external", "summary": "RHBZ#2515840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859" }, { "category": "external", "summary": "https://go.dev/cl/803320", "url": "https://go.dev/cl/803320" }, { "category": "external", "summary": "https://go.dev/issue/80481", "url": "https://go.dev/issue/80481" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6088", "url": "https://pkg.go.dev/vuln/GO-2026-6088" } ], "release_date": "2026-08-13T21:58:52.959000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue" }, { "cve": "CVE-2026-56860", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-13T22:13:18.319384+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515820" } ], "notes": [ { "category": "description", "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments ('..') may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "category": "external", "summary": "RHBZ#2515820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860" }, { "category": "external", "summary": "https://go.dev/cl/803681", "url": "https://go.dev/cl/803681" }, { "category": "external", "summary": "https://go.dev/issue/80494", "url": "https://go.dev/issue/80494" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6218", "url": "https://pkg.go.dev/vuln/GO-2026-6218" } ], "release_date": "2026-08-13T21:58:53.731000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution" }, { "cve": "CVE-2026-56862", "cwe": { "id": "CWE-1050", "name": "Excessive Platform Resource Consumption within a Loop" }, "discovery_date": "2026-08-13T22:16:41.928450+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515839" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "category": "external", "summary": "RHBZ#2515839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862" }, { "category": "external", "summary": "https://go.dev/cl/804261", "url": "https://go.dev/cl/804261" }, { "category": "external", "summary": "https://go.dev/issue/80528", "url": "https://go.dev/issue/80528" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6090", "url": "https://pkg.go.dev/vuln/GO-2026-6090" } ], "release_date": "2026-08-13T21:58:53.216000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages" }, { "cve": "CVE-2026-57231", "cwe": { "id": "CWE-914", "name": "Improper Control of Dynamically-Identified Variables" }, "discovery_date": "2026-06-26T17:01:34.294165+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2493620" } ], "notes": [ { "category": "description", "text": "A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Podman to pass host environment variables into the container. Consequently, a malicious image could exfiltrate all Podman environment variables set in the session from which the container is launched, leading to information disclosure.", "title": "Vulnerability description" }, { "category": "summary", "text": "podman: Podman: Information disclosure via malicious container image environment variables", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-57231" }, { "category": "external", "summary": "RHBZ#2493620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493620" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57231", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57231" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57231", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57231" }, { "category": "external", "summary": "https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050", "url": "https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050" }, { "category": "external", "summary": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68", "url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68" } ], "release_date": "2026-06-26T16:29:02.092000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "podman: Podman: Information disclosure via malicious container image environment variables" }, { "cve": "CVE-2026-59197", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2026-07-14T17:01:29.487456+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500043" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.", "title": "Vulnerability description" }, { "category": "summary", "text": "Pillow: Pillow: Native heap out-of-bounds write", "title": "Vulnerability summary" }, { "category": "other", "text": "Pillow's RankFilter API is vulnerable to a native heap out-of-bounds write when a caller supplies a very large odd filter size. Expansion runs before size validation and ImagingExpand uses unchecked signed integer arithmetic for output dimensions. A remote attacker who can drive RankFilter with attacker-controlled sizes may crash the process or corrupt heap memory. Fixed in Pillow 12.3.0.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59197" }, { "category": "external", "summary": "RHBZ#2500043", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500043" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59197", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1", "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/pull/9695", "url": "https://github.com/python-pillow/Pillow/pull/9695" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr" } ], "release_date": "2026-07-14T16:25:23.520000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Pillow: Pillow: Native heap out-of-bounds write" }, { "cve": "CVE-2026-59199", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "discovery_date": "2026-07-14T17:02:51.371888+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500061" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the library's image processing functions, specifically when handling image coordinates near certain limits. This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable.", "title": "Vulnerability description" }, { "category": "summary", "text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing", "title": "Vulnerability summary" }, { "category": "other", "text": "The impact is limited to denial of service. While the underlying issue is a heap out-of-bounds write, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59199" }, { "category": "external", "summary": "RHBZ#2500061", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500061" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59199", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b", "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/pull/9703", "url": "https://github.com/python-pillow/Pillow/pull/9703" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4" } ], "release_date": "2026-07-14T15:42:15.071000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing" }, { "cve": "CVE-2026-59200", "cwe": { "id": "CWE-409", "name": "Improper Handling of Highly Compressed Data (Data Amplification)" }, "discovery_date": "2026-07-14T17:02:45.929986+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500060" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the PdfParser.PdfStream.decode() function when processing a crafted FlateDecode PDF stream. By providing a specially designed PDF file, the attacker could cause the application to exhaust available memory, leading to a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "Pillow: Pillow: Denial of service via crafted PDF stream", "title": "Vulnerability summary" }, { "category": "other", "text": "The impact is limited to denial of service via memory exhaustion. A small crafted PDF input can force unbounded decompression, but this does not lead to code execution or information disclosure.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59200" }, { "category": "external", "summary": "RHBZ#2500060", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500060" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59200", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59200" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59200", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59200" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09", "url": "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/pull/9718", "url": "https://github.com/python-pillow/Pillow/pull/9718" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565" } ], "release_date": "2026-07-14T16:09:05.091000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Pillow: Pillow: Denial of service via crafted PDF stream" }, { "cve": "CVE-2026-59204", "cwe": { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size" }, "discovery_date": "2026-07-14T16:02:11.802781+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500022" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures.", "title": "Vulnerability description" }, { "category": "summary", "text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image", "title": "Vulnerability summary" }, { "category": "other", "text": "The impact is limited to denial of service via excessive memory allocation. A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59204" }, { "category": "external", "summary": "RHBZ#2500022", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500022" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59204", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59204" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59204", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59204" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca", "url": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/pull/9704", "url": "https://github.com/python-pillow/Pillow/pull/9704" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j" } ], "release_date": "2026-07-14T15:38:29.545000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer.\n\nFor services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image" }, { "cve": "CVE-2026-59205", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')" }, "discovery_date": "2026-07-14T17:02:11.367224+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500052" } ], "notes": [ { "category": "description", "text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows an attacker to trigger controlled native heap corruption by supplying an output image whose mode does not match the transform's declared output mode when using the ImageCms.ImageCmsTransform.apply API. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.", "title": "Vulnerability description" }, { "category": "summary", "text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API", "title": "Vulnerability summary" }, { "category": "other", "text": "The impact is limited to denial of service. While the underlying issue is heap corruption via mode mismatch, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59205" }, { "category": "external", "summary": "RHBZ#2500052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500052" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59205", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59205" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59205", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59205" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721", "url": "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/pull/9715", "url": "https://github.com/python-pillow/Pillow/pull/9715" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0" }, { "category": "external", "summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6" } ], "release_date": "2026-07-14T15:48:39.962000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm.\n\nRHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API" }, { "cve": "CVE-2026-59869", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "discovery_date": "2026-07-08T16:01:38.408322+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2498122" } ], "notes": [ { "category": "description", "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59869" }, { "category": "external", "summary": "RHBZ#2498122", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7", "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4", "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0", "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0", "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m", "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m" } ], "release_date": "2026-07-08T15:15:54.675000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents" }, { "cve": "CVE-2026-59885", "cwe": { "id": "CWE-1050", "name": "Excessive Platform Resource Consumption within a Loop" }, "discovery_date": "2026-07-14T18:17:12.157807+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500380" } ], "notes": [ { "category": "description", "text": "A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.", "title": "Vulnerability description" }, { "category": "summary", "text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER", "title": "Vulnerability summary" }, { "category": "other", "text": "A flaw was found in pyasn1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call, allowing denial of service in applications that decode untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos). The corresponding encoders exhibit the same behavior when re-encoding attacker-supplied values. The arc-size limit introduced for CVE-2026-23490 does not mitigate this issue. This issue is fixed in pyasn1 version 0.6.4.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59885" }, { "category": "external", "summary": "RHBZ#2500380", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500380" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59885", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59885" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9", "url": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj", "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj" } ], "release_date": "2026-07-14T16:40:00.515000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER" }, { "cve": "CVE-2026-59886", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-07-14T17:01:19.689422+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2500041" } ], "notes": [ { "category": "description", "text": "A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw in pyasn1, rated as Important, could lead to a denial of service in Red Hat products that process untrusted ASN.1 data. A remote attacker could send a specially crafted BER, CER, or DER encoded REAL value with a large exponent, causing applications to consume excessive resources during decoding operations such as printing, logging, or arithmetic, thereby rendering the service unavailable.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-59886" }, { "category": "external", "summary": "RHBZ#2500041", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500041" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59886", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59886" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886", "url": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4" }, { "category": "external", "summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r", "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r" } ], "release_date": "2026-07-14T16:38:29.691000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values" }, { "cve": "CVE-2026-67213", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "discovery_date": "2026-07-29T14:01:09.009518+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2508406" } ], "notes": [ { "category": "description", "text": "A flaw was found in nanoid (Nano ID), a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service (DoS) condition by hanging the application's calling thread.", "title": "Vulnerability description" }, { "category": "summary", "text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation", "title": "Vulnerability summary" }, { "category": "other", "text": "An algorithmic denial of service flaw was found in the `nanoid` library. When calling `customAlphabet` or `customRandom` with a `size` parameter of `0`, the internal generation loop fails to meet its termination condition. In Node.js or browser execution contexts, an attacker who supplies an unvalidated, zero-value size parameter to these functions causes the thread to enter an infinite loop, driving CPU utilization to 100% and completely blocking event loop execution for that thread.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-67213" }, { "category": "external", "summary": "RHBZ#2508406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67213", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67213" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67213", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67213" }, { "category": "external", "summary": "https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7", "url": "https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7" }, { "category": "external", "summary": "https://github.com/ai/nanoid/releases/tag/5.1.6", "url": "https://github.com/ai/nanoid/releases/tag/5.1.6" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom", "url": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom" } ], "release_date": "2026-07-29T13:32:01.534000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this issue, ensure application code validates the size parameter passed to customAlphabet or customRandom, rejecting or sanitizing zero-value inputs before passing them to nanoid.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation" }, { "cve": "CVE-2026-67214", "cwe": { "id": "CWE-839", "name": "Numeric Range Comparison Without Minimum Check" }, "discovery_date": "2026-07-29T14:01:28.637584+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2508411" } ], "notes": [ { "category": "description", "text": "A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions", "title": "Vulnerability summary" }, { "category": "other", "text": "An input validation flaw in Nano ID's non-secure module (`nanoid/non-secure`) causes an infinite loop in the `customAlphabet` and `nanoid` functions when processed with a negative size parameter. Because the decrementing loop counter never meets its termination condition, an unauthenticated attacker who passes an unvalidated negative integer value can block the NodeJS event loop, resulting in a thread hang and complete Denial of Service (DoS) for the host application.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-67214" }, { "category": "external", "summary": "RHBZ#2508411", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508411" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67214", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67214" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67214", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67214" }, { "category": "external", "summary": "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49", "url": "https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49" }, { "category": "external", "summary": "https://github.com/ai/nanoid/releases/tag/5.1.16", "url": "https://github.com/ai/nanoid/releases/tag/5.1.16" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module", "url": "https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module" } ], "release_date": "2026-07-29T13:32:02.265000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Sanitize all user-supplied integer inputs before passing them to `nanoid` or `customAlphabet` functions in the `nanoid/non-secure` module, ensuring the size parameter is strictly a non-negative integer.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions" }, { "cve": "CVE-2026-67313", "discovery_date": "2026-08-01T13:03:08.824485+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "notes": [ { "category": "description", "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.", "title": "Vulnerability description" }, { "category": "other", "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-67313" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313" } ], "release_date": "2026-08-01T12:22:16.493000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON" }, { "cve": "CVE-2026-67314", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2026-08-01T13:03:49.884962+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2510030" } ], "notes": [ { "category": "description", "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-67314" }, { "category": "external", "summary": "RHBZ#2510030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g", "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields", "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields" } ], "release_date": "2026-08-01T12:22:16.603000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth" }, { "cve": "CVE-2026-67320", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2026-08-01T13:01:50.659496+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2509993" } ], "notes": [ { "category": "description", "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-67320" }, { "category": "external", "summary": "RHBZ#2509993", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320" }, { "category": "external", "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc", "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9", "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter", "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter" } ], "release_date": "2026-08-01T12:22:17.547000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter" }, { "cve": "CVE-2026-67321", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-01T13:02:49.231124+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2510011" } ], "notes": [ { "category": "description", "text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.", "title": "Vulnerability description" }, { "category": "summary", "text": "axios: axios: Denial of Service via object serialization bypass", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-67321" }, { "category": "external", "summary": "RHBZ#2510011", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321" }, { "category": "external", "summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23", "url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass", "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass" } ], "release_date": "2026-08-01T12:22:18.177000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "axios: axios: Denial of Service via object serialization bypass" }, { "cve": "CVE-2026-69152", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-03T18:01:13.566423+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2510722" } ], "notes": [ { "category": "description", "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.", "title": "Vulnerability description" }, { "category": "summary", "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "title": "Vulnerability summary" }, { "category": "other", "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-69152" }, { "category": "external", "summary": "RHBZ#2510722", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031" }, { "category": "external", "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895" } ], "release_date": "2026-08-03T16:33:36.324000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation" }, { "cve": "CVE-2026-69153", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-08-03T18:01:01.506065+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2510719" } ], "notes": [ { "category": "description", "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.", "title": "Vulnerability description" }, { "category": "summary", "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-69153" }, { "category": "external", "summary": "RHBZ#2510719", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153" }, { "category": "external", "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8", "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8" }, { "category": "external", "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19", "url": "https://github.com/postcss/postcss/releases/tag/8.5.19" }, { "category": "external", "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp", "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp" } ], "release_date": "2026-08-03T16:56:25.733000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL" }, { "cve": "CVE-2026-73086", "cwe": { "id": "CWE-1241", "name": "Use of Predictable Algorithm in Random Number Generator" }, "discovery_date": "2026-08-11T17:11:45.607696+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2514175" } ], "notes": [ { "category": "description", "text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nanoid: nanoid: Predictable ID generation due to integer overflow", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-73086" }, { "category": "external", "summary": "RHBZ#2514175", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73086" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086" }, { "category": "external", "summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4" }, { "category": "external", "summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3" }, { "category": "external", "summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac" }, { "category": "external", "summary": "https://github.com/ai/nanoid/releases/tag/3.3.12", "url": "https://github.com/ai/nanoid/releases/tag/3.3.12" }, { "category": "external", "summary": "https://github.com/ai/nanoid/releases/tag/5.1.11", "url": "https://github.com/ai/nanoid/releases/tag/5.1.11" }, { "category": "external", "summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w" } ], "release_date": "2026-08-11T16:46:23.024000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nanoid: nanoid: Predictable ID generation due to integer overflow" }, { "cve": "CVE-2026-73088", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2026-08-11T17:11:53.228719+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2514177" } ], "notes": [ { "category": "description", "text": "A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "browserslist: Browserslist: Prototype pollution leading to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important vulnerability. The browserslist package, a front-end development tool, is vulnerable to prototype pollution when processing untrusted statistics data. This flaw can lead to a denial of service, as malicious input can crash applications that use the affected library. The impact is considered Important due to the potential for remote exploitation without authentication or user interaction, directly affecting service availability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-73088" }, { "category": "external", "summary": "RHBZ#2514177", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514177" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73088", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088" }, { "category": "external", "summary": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51", "url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51" }, { "category": "external", "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7", "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7" }, { "category": "external", "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g", "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g" } ], "release_date": "2026-08-11T17:00:05.869000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "browserslist: Browserslist: Prototype pollution leading to denial of service" }, { "cve": "CVE-2026-73089", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-11T17:12:48.012036+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2514195" } ], "notes": [ { "category": "description", "text": "A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.", "title": "Vulnerability description" }, { "category": "summary", "text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in the `browserslist` library, which is used across several Red Hat products and services. The flaw allows an attacker to trigger unbounded memory growth by influencing query values, potentially leading to an out-of-memory crash and service unavailability. This is considered Important due to the potential for remote exploitation and significant impact on service stability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-73089" }, { "category": "external", "summary": "RHBZ#2514195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514195" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73089", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089" }, { "category": "external", "summary": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405", "url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405" }, { "category": "external", "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7", "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7" }, { "category": "external", "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx", "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx" } ], "release_date": "2026-08-11T17:05:38.760000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results" }, { "cve": "CVE-2026-84375", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "discovery_date": "2026-09-01T21:51:30.205823+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2527118" } ], "notes": [ { "category": "description", "text": "A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.", "title": "Vulnerability description" }, { "category": "summary", "text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in js-yaml, affecting applications that process untrusted YAML input. The flaw allows an attacker to craft a small YAML document that, when parsed, can lead to prolonged CPU consumption due to inefficient merge key processing, potentially exhausting system resources. This is particularly relevant where applications handle external YAML data and have merge processing enabled by default.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "known_not_affected": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-84375" }, { "category": "external", "summary": "RHBZ#2527118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527118" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84375", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84375" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639", "url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480", "url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b", "url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/pull/797", "url": "https://github.com/nodeca/js-yaml/pull/797" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2", "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2", "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2" }, { "category": "external", "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh", "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh" } ], "release_date": "2026-09-01T21:43:13.617000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:59:52+00:00", "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11458", "product_ids": [ "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:1f694daf74afa33a0d94fb8858a6878793d5b96148dcc77ef9291451966b7138_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f80a60db45e7833e69e42a08f08f848fe58f8e7c9cdcec41a40d6a204142793b_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c25fea72a35277ae55647d93908f16d968944ef4401893b7001e0a5cfbdfbdf8_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:73f69e28443a678474d5c4b22cfc1cb7f399a297b3c856dc4838c5d139771551_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:90265feb2504477c4669609911a642bf93f79e6181e528c264fcdda5eba2f6af_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:16cf30e26cc9394960f5d67f7ce4ce77c4633456a7220000fe7b2f7676ae8905_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:745ef44b9fb3d4074af1d9ab2a01db555283cf2e3e3d11deede64e5dd4a67785_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:839938dad861101606c706996240537e734dbba2d46792a3a1b277d9fbf81f2c_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-bundle@sha256:5f89f2c53adcf4221f10ea0f55ae8b7ba8e5ebbd0094303803831d8c2ae02686_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:360e96f5762ee46b0b49e2d4553096072f22574e9c3822733c15fc5860d715f5_ppc64le", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-operator-rhel8@sha256:a4c208d9862637179906b3ef6c3804ec8b4b2c5aa6e373245d90375b0583bef3_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64", "Red Hat Quay 3.14:registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing" } ] }