Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-27459 (GCVE-0-2026-27459)
Vulnerability from cvelistv5 – Published: 2026-03-17 23:34 – Updated: 2026-08-17 12:04
VLAI
EPSS
VEX
Title
pyOpenSSL DTLS cookie callback buffer overflow
Summary
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-18 19:52 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
25 references
Impacted products
48 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| pyca | pyopenssl |
Affected:
>= 22.0.0, < 26.0.0
|
guessed | |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:26.0.0-1.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:26.0.0-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:4.7.11-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:26.0.0-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 |
Unaffected:
0:24.1.0-2.el8pc , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el8 |
||
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 |
Unaffected:
0:24.1.0-2.el9pc , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el9 |
||
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 |
Unaffected:
0:25.1.0-0.3.el9pc , < *
(rpm)
cpe:/a:redhat:satellite:6.17::el9 cpe:/a:redhat:satellite_capsule:6.17::el9 |
||
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 |
Unaffected:
0:26.0.0-2.el9pc , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 cpe:/a:redhat:satellite_capsule:6.18::el9 |
||
| Red Hat | RHUI 4 for RHEL 8 |
Unaffected:
0:24.1.0-2.el8ui , < *
(rpm)
cpe:/a:redhat:rhui:4::el8 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1777398315 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1777403872 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777390240 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777296732 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777391447 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777299023 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777387242 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777390333 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
2.20.0-0.8.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
26.0.0-1.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Quay 3.1 |
Unaffected:
1776736910 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
||
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1776752646 , < *
(rpm)
cpe:/a:redhat:quay:3.12::el8 |
||
| Red Hat | Red Hat Quay 3.14 |
Unaffected:
1779689392 , < *
(rpm)
cpe:/a:redhat:quay:3.14::el8 |
||
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1780891395 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
||
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1779204086 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
||
| Red Hat | Red Hat Quay 3.17 |
Unaffected:
1779922205 , < *
(rpm)
cpe:/a:redhat:quay:3.17::el9 |
||
| Red Hat | Red Hat Quay 3.18 |
Unaffected:
1784987273 , < *
(rpm)
cpe:/a:redhat:quay:3.18::el9 |
||
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1776782369 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
||
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
Unaffected:
1775815407 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.4::el9 |
||
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1
|
||
| Red Hat | Exploit Intelligence |
cpe:/a:redhat:exploit_intelligence:0
|
||
| Red Hat | Lightspeed Core |
cpe:/a:redhat:lightspeed_core
|
||
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2
|
||
| Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 |
cpe:/a:redhat:ansible_core:2
|
||
| Red Hat | Red Hat Ceph Storage 7 |
cpe:/a:redhat:ceph_storage:7
|
||
| Red Hat | Red Hat Ceph Storage 8 |
cpe:/a:redhat:ceph_storage:8
|
||
| Red Hat | Red Hat Ceph Storage 9 |
cpe:/a:redhat:ceph_storage:9
|
||
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
||
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
||
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
||
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1
|
||
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers |
cpe:/a:redhat:rhui:4::el8
|
||
| Red Hat | Red Hat Update Infrastructure 5 |
cpe:/a:redhat:rhui:5::el9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27459",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-18T19:52:08.536876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T19:52:15.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-1.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.7.11-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el8",
"cpe:/a:redhat:satellite_capsule:6.16::el8"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Satellite 6.16 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:24.1.0-2.el8pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el9",
"cpe:/a:redhat:satellite_capsule:6.16::el9"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Satellite 6.16 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:24.1.0-2.el9pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.17::el9",
"cpe:/a:redhat:satellite_capsule:6.17::el9"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Satellite 6.17 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:25.1.0-0.3.el9pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9",
"cpe:/a:redhat:satellite_capsule:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Satellite 6.18 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-2.el9pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:4::el8"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "RHUI 4 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:24.1.0-2.el8ui",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/ee-supported-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777398315",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/lightspeed-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777403872",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ansible-dev-tools-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777390240",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/eda-controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777296732",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777391447",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/hub-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777299023",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777387242",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777390333",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "jaeger-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2.20.0-0.8.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "pyopenssl-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.0.0-1.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776736910",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776752646",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.14::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779689392",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780891395",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779204086",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.17::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779922205",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.18::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784987273",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776782369",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/model-transparency-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775815407",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "unaffected",
"packageName": "openshift-sandboxed-containers/osc-podvm-builder-rhel9",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:exploit_intelligence:0"
],
"defaultStatus": "affected",
"packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9",
"product": "Exploit Intelligence",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lightspeed_core"
],
"defaultStatus": "unaffected",
"packageName": "lightspeed-core/lightspeed-stack-rhel9",
"product": "Lightspeed Core",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lightspeed_core"
],
"defaultStatus": "unaffected",
"packageName": "lightspeed-core/rag-tool-cpu-rhel9",
"product": "Lightspeed Core",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lightspeed_core"
],
"defaultStatus": "unaffected",
"packageName": "lightspeed-core/rag-tool-cuda-12.9-rhel9",
"product": "Lightspeed Core",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-24/controller-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-24/eda-controller-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-24/ee-minimal-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-24/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-24/hub-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/controller-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/eda-controller-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/ee-minimal-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/hub-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-27/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-27/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3x-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/ee-minimal-rhel8",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel8",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:7"
],
"defaultStatus": "affected",
"packageName": "rhceph/rhceph-7-rhel9",
"product": "Red Hat Ceph Storage 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:8"
],
"defaultStatus": "affected",
"packageName": "rhceph/rhceph-8-rhel9",
"product": "Red Hat Ceph Storage 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
],
"defaultStatus": "affected",
"packageName": "rhceph/rhceph-9-rhel9",
"product": "Red Hat Ceph Storage 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb11.8",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "python-sentry-sdk",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "python-trustme",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-feature-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-mlflow-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-model-registry-job-async-upload-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-ironic-agent-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-ironic-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "pyOpenSSL",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "python-redis",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-cinder-api-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-cinder-backup-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-cinder-base-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-cinder-scheduler-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-cinder-volume-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-glance-api-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-manila-share-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-nova-compute-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso/openstack-openstackclient-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "python-redis",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "python-urllib3",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-advisor-engine-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-insights-engine-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-vmaas-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "tfm-pulpcore-python-pyOpenSSL",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:4::el8"
],
"defaultStatus": "affected",
"packageName": "python-redis",
"product": "Red Hat Update Infrastructure 4 for Cloud Providers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:4::el8"
],
"defaultStatus": "affected",
"packageName": "python-urllib3",
"product": "Red Hat Update Infrastructure 4 for Cloud Providers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-kubernetes-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/rhua-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-17T23:34:28.483Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T12:04:57.448Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"name": "RHBZ#2448503",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10754"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14874"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14873"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14835"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13553"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22465"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11916"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11996"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:10754: RHUI 4 for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:14874: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:14873: Red Hat Satellite 6.17 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:14835: Red Hat Satellite 6.18 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13553: Red Hat Ansible Automation Platform 2.5"
},
{
"lang": "en",
"value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:48758: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:7224: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:11856: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:21017: Red Hat Quay 3.14"
},
{
"lang": "en",
"value": "RHSA-2026:24853: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:22465: Red Hat Quay 3.17"
},
{
"lang": "en",
"value": "RHSA-2026:48085: Red Hat Quay 3.18"
},
{
"lang": "en",
"value": "RHSA-2026:11916: Red Hat Quay 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:11996: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:8437: Red Hat Trusted Artifact Signer 1.4"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-18T00:01:41.404Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-17T23:34:28.483Z",
"value": "Made public."
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "pyopenssl",
"vendor": "pyca",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 26.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T23:34:28.483Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
},
{
"name": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"name": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
}
],
"source": {
"advisory": "GHSA-5pwr-322w-8jr4",
"discovery": "UNKNOWN"
},
"title": "pyOpenSSL DTLS cookie callback buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27459",
"datePublished": "2026-03-17T23:34:28.483Z",
"dateReserved": "2026-02-19T17:25:31.100Z",
"dateUpdated": "2026-08-17T12:04:57.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-27459",
"date": "2026-08-17",
"epss": "0.00704",
"percentile": "0.50285"
},
"microsoft_vex": {
"current_release_date": "2026-03-21T01:37:02.000Z",
"cve": "CVE-2026-27459",
"id": "msrc_CVE-2026-27459",
"initial_release_date": "2026-03-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "pyOpenSSL DTLS cookie callback buffer overflow",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27459.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-27459\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-18T00:16:19.273\",\"lastModified\":\"2026-08-17T12:17:40.780\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.\"},{\"lang\":\"es\",\"value\":\"pyOpenSSL es un envoltorio de Python para la biblioteca OpenSSL. A partir de la versi\u00f3n 22.0.0 y antes de la versi\u00f3n 26.0.0, si una devoluci\u00f3n de llamada proporcionada por el usuario a set_cookie_generate_callback devolv\u00eda un valor de cookie superior a 256 bytes, pyOpenSSL desbordar\u00eda un b\u00fafer proporcionado por OpenSSL. A partir de la versi\u00f3n 26.0.0, los valores de cookie que son demasiado largos ahora son rechazados.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"pyca\",\"product\":\"pyopenssl\",\"versions\":[{\"version\":\"\u003e= 22.0.0, \u003c 26.0.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"0:26.0.0-1.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"],\"versions\":[{\"version\":\"0:26.0.0-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:4.7.11-2.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:26.0.0-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el8\",\"cpe:/a:redhat:satellite_capsule:6.16::el8\"],\"versions\":[{\"version\":\"0:24.1.0-2.el8pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el9\",\"cpe:/a:redhat:satellite_capsule:6.16::el9\"],\"versions\":[{\"version\":\"0:24.1.0-2.el9pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.17 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.17::el9\",\"cpe:/a:redhat:satellite_capsule:6.17::el9\"],\"versions\":[{\"version\":\"0:25.1.0-0.3.el9pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\",\"cpe:/a:redhat:satellite_capsule:6.18::el9\"],\"versions\":[{\"version\":\"0:26.0.0-2.el9pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"RHUI 4 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:rhui:4::el8\"],\"versions\":[{\"version\":\"0:24.1.0-2.el8ui\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/ee-supported-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1777398315\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/lightspeed-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1777403872\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/ansible-dev-tools-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777390240\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/eda-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777296732\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/ee-supported-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777391447\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777299023\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777387242\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/platform-resource-runner-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777390333\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jaeger-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"2.20.0-0.8.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyopenssl-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"26.0.0-1.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"],\"versions\":[{\"version\":\"1776736910\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"],\"versions\":[{\"version\":\"1776752646\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.14::el8\"],\"versions\":[{\"version\":\"1779689392\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"],\"versions\":[{\"version\":\"1780891395\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1779204086\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.17::el9\"],\"versions\":[{\"version\":\"1779922205\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.18::el9\"],\"versions\":[{\"version\":\"1784987273\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"],\"versions\":[{\"version\":\"1776782369\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/model-transparency-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"],\"versions\":[{\"version\":\"1775815407\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-sandboxed-containers/osc-podvm-builder-rhel9\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Exploit Intelligence\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"exploit-intelligence-tech-preview/vulnerability-analysis-rhel9\",\"cpes\":[\"cpe:/a:redhat:exploit_intelligence:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Lightspeed Core\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lightspeed-core/lightspeed-stack-rhel9\",\"cpes\":[\"cpe:/a:redhat:lightspeed_core\"]},{\"vendor\":\"Red Hat\",\"product\":\"Lightspeed Core\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lightspeed-core/rag-tool-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:lightspeed_core\"]},{\"vendor\":\"Red Hat\",\"product\":\"Lightspeed Core\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lightspeed-core/rag-tool-cuda-12.9-rhel9\",\"cpes\":[\"cpe:/a:redhat:lightspeed_core\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/eda-controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/hub-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/eda-controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/hub-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-27/controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-27/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3x-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-tech-preview/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-tech-preview/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-7-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-8-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-9-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mariadb11.8\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-sentry-sdk\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-trustme\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-feature-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llama-stack-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-registry-job-async-upload-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-ironic-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-ironic-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-redis\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-cinder-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-cinder-backup-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-cinder-base-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-cinder-scheduler-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-cinder-volume-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-glance-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-manila-share-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-nova-compute-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso/openstack-openstackclient-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-redis\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-advisor-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-insights-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-vmaas-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"tfm-pulpcore-python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 4 for Cloud Providers\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-redis\",\"cpes\":[\"cpe:/a:redhat:rhui:4::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 4 for Cloud Providers\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:rhui:4::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhui5/cds-kubernetes-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhui5/cds-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhui5/rhua-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-18T19:52:08.536876Z\",\"id\":\"CVE-2026-27459\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"22.0.0\",\"versionEndExcluding\":\"26.0.0\",\"matchCriteriaId\":\"36CBBDFE-83B3-4F32-98E6-49E62AD0BD1B\"}]}]}],\"references\":[{\"url\":\"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10754\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11856\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11996\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13508\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13512\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13545\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13553\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14835\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14873\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14874\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21017\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22465\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:48085\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:48758\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7224\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8437\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-27459\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2448503\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-17T19:28:27+00:00",
"cve": "CVE-2026-27459",
"id": "CVE-2026-27459",
"initial_release_date": "2026-03-17T23:34:28.483000+00:00",
"product_status:fixed": "106",
"product_status:known_affected": "34",
"product_status:known_not_affected": "1494",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "pyOpenSSL: DTLS cookie callback buffer overflow",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-07-21T13:15:50Z",
"cve": "CVE-2026-27459",
"id": "CVE-2026-27459",
"initial_release_date": "2026-03-19T00:26:05Z",
"product_status:known_affected": "410",
"product_status:known_not_affected": "52",
"product_status:recommended": "44",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-27459",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-27459.json",
"version": "22"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"pyOpenSSL: DTLS cookie callback buffer overflow\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-1.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.7.11-2.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:24.1.0-2.el8pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:24.1.0-2.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_capsule:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:25.1.0-0.3.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\", \"cpe:/a:redhat:satellite_capsule:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-2.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:4::el8\"], \"vendor\": \"Red Hat\", \"product\": \"RHUI 4 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:24.1.0-2.el8ui\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777398315\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/ee-supported-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777403872\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/lightspeed-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777390240\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/ansible-dev-tools-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777296732\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/eda-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777391447\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/ee-supported-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777299023\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/hub-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777387242\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/lightspeed-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777390333\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/platform-resource-runner-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.20.0-0.8.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jaeger-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.0.0-1.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"pyopenssl-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776736910\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776752646\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779689392\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780891395\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779204086\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779922205\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784987273\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776782369\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775815407\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/model-transparency-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"openshift-sandboxed-containers/osc-podvm-builder-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:exploit_intelligence:0\"], \"vendor\": \"Red Hat\", \"product\": \"Exploit Intelligence\", \"packageName\": \"exploit-intelligence-tech-preview/vulnerability-analysis-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_core\"], \"vendor\": \"Red Hat\", \"product\": \"Lightspeed Core\", \"packageName\": \"lightspeed-core/lightspeed-stack-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_core\"], \"vendor\": \"Red Hat\", \"product\": \"Lightspeed Core\", \"packageName\": \"lightspeed-core/rag-tool-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_core\"], \"vendor\": \"Red Hat\", \"product\": \"Lightspeed Core\", \"packageName\": \"lightspeed-core/rag-tool-cuda-12.9-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/eda-controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/ee-minimal-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/hub-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/eda-controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/ee-minimal-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/hub-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-27/controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-27/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.11-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3x-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform/ee-minimal-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform-tech-preview/ee-minimal-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform-tech-preview/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 7\", \"packageName\": \"rhceph/rhceph-7-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 8\", \"packageName\": \"rhceph/rhceph-8-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 9\", \"packageName\": \"rhceph/rhceph-9-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"mariadb11.8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"python-sentry-sdk\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"python-trustme\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-feature-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llama-stack-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlflow-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-registry-job-async-upload-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-ironic-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-ironic-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"python-redis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-cinder-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-cinder-backup-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-cinder-base-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-cinder-scheduler-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-cinder-volume-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-glance-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-manila-share-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-nova-compute-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso/openstack-openstackclient-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"python-redis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-advisor-engine-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-insights-engine-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-vmaas-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"tfm-pulpcore-python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:4::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 4 for Cloud Providers\", \"packageName\": \"python-redis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:4::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 4 for Cloud Providers\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"packageName\": \"rhui5/cds-kubernetes-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"packageName\": \"rhui5/cds-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"packageName\": \"rhui5/rhua-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-18T00:01:41.404Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-17T23:34:28.483Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10754: RHUI 4 for RHEL 8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14874: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14873: Red Hat Satellite 6.17 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14835: Red Hat Satellite 6.18 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13553: Red Hat Ansible Automation Platform 2.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:48758: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7224: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11856: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21017: Red Hat Quay 3.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24853: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22465: Red Hat Quay 3.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:48085: Red Hat Quay 3.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11916: Red Hat Quay 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11996: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8437: Red Hat Trusted Artifact Signer 1.4\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-17T23:34:28.483Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-27459\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2448503\", \"name\": \"RHBZ#2448503\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13512\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10754\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14874\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13508\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14873\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14835\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13553\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13545\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:48758\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7224\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11856\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21017\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22465\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:48085\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11996\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8437\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-17T12:04:57.448Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-27459\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-18T19:52:08.536876Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-18T19:52:12.530Z\"}}], \"cna\": {\"title\": \"pyOpenSSL DTLS cookie callback buffer overflow\", \"source\": {\"advisory\": \"GHSA-5pwr-322w-8jr4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"pyca\", \"product\": \"pyopenssl\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 22.0.0, \u003c 26.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4\", \"name\": \"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408\", \"name\": \"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst\", \"name\": \"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-17T23:34:28.483Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-27459\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-17T12:04:57.448Z\", \"dateReserved\": \"2026-02-19T17:25:31.100Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-17T23:34:28.483Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:24853
Vulnerability from csaf_redhat - Published: 2026-06-09 15:31 - Updated: 2026-08-18 07:31Summary
Red Hat Security Advisory: Red Hat Quay 3.15.5
Severity
Important
Notes
Topic: Red Hat Quay 3.15.5 is now available with bug fixes.
Details: Quay 3.15.5
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.
6.5 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
No description is available for this CVE.
CWE-129 - Improper Validation of Array IndexAffected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
9.1 (Critical)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Low
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Moderate
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.
7.3 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.
7.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
Threats
Impact
Important
References
167 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.15.5 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.15.5",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:24853",
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2377",
"url": "https://access.redhat.com/security/cve/CVE-2026-2377"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32286",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32589",
"url": "https://access.redhat.com/security/cve/CVE-2026-32589"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33894",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39892",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40192",
"url": "https://access.redhat.com/security/cve/CVE-2026-40192"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40895",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42033",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42035",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42041",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42043",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42044",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24853.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.15.5",
"tracking": {
"current_release_date": "2026-08-18T07:31:45+00:00",
"generator": {
"date": "2026-08-18T07:31:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:24853",
"initial_release_date": "2026-06-09T15:31:40+00:00",
"revision_history": [
{
"date": "2026-06-09T15:31:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-18T07:31:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.15",
"product": {
"name": "Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.15::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1780585491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ab1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Adb0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1780585598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Af32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1780590413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Aef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1780894591"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aafeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ad3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ae76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-2377",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-02-11T21:02:44.495000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2439201"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application\u0027s internal network, potentially leading to the disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Due to the intended and supported use case of Openshift Mirror Registry, deployment in an offline or network-isolated environment, the impact for this product has been downgraded to `Moderate`.\n\nEven in case of compromise, the blast radius is restricted to mirror-registry. It can not be escalated outside the core product. This vulnerability has been scored based on the lack of change of scope.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2377"
},
{
"category": "external",
"summary": "RHBZ#2439201",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439201"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2377"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377"
}
],
"release_date": "2026-04-08T16:18:10.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality"
},
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32589",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-03-12T14:43:07.878000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446963"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user\u0027s in-progress image upload.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: insecure direct object reference in BlobUpload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials to the Quay registry. Unauthenticated users cannot exploit this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32589"
},
{
"category": "external",
"summary": "RHBZ#2446963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446963"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32589"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: insecure direct object reference in BlobUpload"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32590",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-03-12T14:43:11.443000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: remote code execution using pickle deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "RHBZ#2446964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mirror-registry: remote code execution using pickle deserialization"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33894",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-27T21:02:52.462999+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "RHBZ#2452464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33894"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc2313#section-8",
"url": "https://datatracker.ietf.org/doc/html/rfc2313#section-8"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp"
},
{
"category": "external",
"summary": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE",
"url": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc8017.html",
"url": "https://www.rfc-editor.org/rfc/rfc8017.html"
}
],
"release_date": "2026-03-27T20:45:49.583000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-39892",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-08T22:00:59.416053+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In default configurations Red Hat products isolate service processes from total system access. Should an attacker be able to exploit this vulnerability their impact will be limited to that service account and they will not have access to the broader system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "RHBZ#2456735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39892"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/08/12",
"url": "http://www.openwall.com/lists/oss-security/2026/04/08/12"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5",
"url": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"
}
],
"release_date": "2026-04-08T20:49:41.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API"
},
{
"cve": "CVE-2026-40192",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-04-16T00:00:49.590876+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library\u0027s failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40192"
},
{
"category": "external",
"summary": "RHBZ#2458856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40192"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628",
"url": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/pull/9521",
"url": "https://github.com/python-pillow/Pillow/pull/9521"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"
}
],
"release_date": "2026-04-15T22:53:56.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing"
},
{
"cve": "CVE-2026-40895",
"cwe": {
"id": "CWE-212",
"name": "Improper Removal of Sensitive Information Before Storage or Transfer"
},
"discovery_date": "2026-04-21T21:02:33.280553+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460297"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "RHBZ#2460297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
}
],
"release_date": "2026-04-21T19:59:59.759000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects"
},
{
"cve": "CVE-2026-42033",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:20.937507+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "RHBZ#2461607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
}
],
"release_date": "2026-04-24T17:36:44.132000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution"
},
{
"cve": "CVE-2026-42035",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:17.109481+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461606"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application\u0027s core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "RHBZ#2461606",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461606"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
}
],
"release_date": "2026-04-24T17:38:07.752000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-42041",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:41.034289+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461629"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "RHBZ#2461629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
"url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
}
],
"release_date": "2026-04-24T17:55:30.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
},
{
"cve": "CVE-2026-42043",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-04-24T19:01:22.552379+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: NO_PROXY bypass via crafted URL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "RHBZ#2461626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
}
],
"release_date": "2026-04-24T17:54:42.668000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: NO_PROXY bypass via crafted URL"
},
{
"cve": "CVE-2026-42044",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:13.418725+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "RHBZ#2461624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
}
],
"release_date": "2026-04-24T17:49:49.517000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
}
]
}
RHSA-2026:48085
Vulnerability from csaf_redhat - Published: 2026-07-29 17:45 - Updated: 2026-08-18 09:09Summary
Red Hat Security Advisory: Red Hat Quay 3.18.0
Severity
Important
Notes
Topic: Red Hat Quay 3.18.0 is now available with bug fixes and feature enhancements.
Details: Quay 3.18.0
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
No description is available for this CVE.
CWE-129 - Improper Validation of Array IndexAffected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Low
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Moderate
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
5.2 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Important
References
63 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.18.0 is now available with bug fixes and feature enhancements.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.18.0",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48085",
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48085.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.18.0",
"tracking": {
"current_release_date": "2026-08-18T09:09:45+00:00",
"generator": {
"date": "2026-08-18T09:09:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48085",
"initial_release_date": "2026-07-29T17:45:57+00:00",
"revision_history": [
{
"date": "2026-07-29T17:45:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-18T09:09:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.18",
"product": {
"name": "Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784987883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Ae07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1785239883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Ada29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3A8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1785155359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3Af71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3A71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Abde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3Abc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Af2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3Af720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Aef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Ac5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3A4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Afd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Aa3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3A7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32590",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-03-12T14:43:11.443000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: remote code execution using pickle deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "RHBZ#2446964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mirror-registry: remote code execution using pickle deserialization"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
}
]
}
RHSA-2026:48758
Vulnerability from csaf_redhat - Published: 2026-07-30 11:11 - Updated: 2026-08-18 01:18Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Critical
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
jaeger:
* jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)
* jaeger-2.20.0-0.8.hum1.src (src)
Security Fix(es):
jaeger:
* CVE-2026-62995
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.
4.3 (Medium)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.
7.4 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.
7.4 (High)
Affected products
Fixed
3 products
Threats
Impact
Critical
A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
65 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\njaeger:\n * jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)\n * jaeger-2.20.0-0.8.hum1.src (src)\n\nSecurity Fix(es):\n\njaeger:\n * CVE-2026-62995",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48758",
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-62995",
"url": "https://access.redhat.com/security/cve/CVE-2026-62995"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
"url": "https://access.redhat.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67312",
"url": "https://access.redhat.com/security/cve/CVE-2026-67312"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
"url": "https://access.redhat.com/security/cve/CVE-2026-67320"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73086",
"url": "https://access.redhat.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48758.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-18T01:18:37+00:00",
"generator": {
"date": "2026-08-18T01:18:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48758",
"initial_release_date": "2026-07-30T11:11:12+00:00",
"revision_history": [
{
"date": "2026-07-30T11:11:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T13:04:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-18T01:18:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@aarch64",
"product": {
"name": "jaeger-main@aarch64",
"product_id": "jaeger-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@src",
"product": {
"name": "jaeger-main@src",
"product_id": "jaeger-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@x86_64",
"product": {
"name": "jaeger-main@x86_64",
"product_id": "jaeger-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@aarch64"
},
"product_reference": "jaeger-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@src"
},
"product_reference": "jaeger-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@x86_64"
},
"product_reference": "jaeger-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-62995",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-07-29T19:02:04.532795+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508524"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "joserfc: joserfc: JWT Malleability via Non-Standard Padding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: The joserfc Python library, utilized across various Red Hat products, is susceptible to JWT malleability due to its handling of non-standard trailing padding. This flaw could enable an attacker to bypass token revocation or anti-replay mechanisms in applications that depend on the integrity of JWTs processed by vulnerable versions of the library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62995"
},
{
"category": "external",
"summary": "RHBZ#2508524",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508524"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62995"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq",
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq"
}
],
"release_date": "2026-07-29T18:27:06.518000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "joserfc: joserfc: JWT Malleability via Non-Standard Padding"
},
{
"cve": "CVE-2026-67312",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:02:36.502842+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application\u0027s JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the axios JavaScript library allows an unauthenticated remote attacker to cause a denial of service. By submitting crafted form data with excessively nested bracket-delimited field names, an attacker can trigger uncontrolled recursion in the formDataToJSON function (exposed as axios.formToJSON() and used internally by the default transformRequest when FormData is sent with Content-Type: application/json), exhausting the JavaScript call stack and causing a RangeError that may terminate the application process. This vulnerability affects applications that pass attacker-controlled FormData field names to axios\u0027 FormData-to-JSON conversion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67312"
},
{
"category": "external",
"summary": "RHBZ#2510007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"
}
],
"release_date": "2026-08-01T12:22:18.102000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "Upgrade to axios \u003e= 1.18.0 (1.x) or \u003e= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in form data processing"
},
{
"cve": "CVE-2026-67313",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:03:08.824485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "RHBZ#2510017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
"url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
}
],
"release_date": "2026-08-01T12:22:16.493000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
},
{
"cve": "CVE-2026-67314",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:03:49.884962+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510030"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "RHBZ#2510030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
}
],
"release_date": "2026-08-01T12:22:16.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
},
{
"cve": "CVE-2026-67320",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:01:50.659496+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509993"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67320"
},
{
"category": "external",
"summary": "RHBZ#2509993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
"url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
}
],
"release_date": "2026-08-01T12:22:17.547000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
},
{
"cve": "CVE-2026-67321",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-01T13:02:49.231124+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via object serialization bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "RHBZ#2510011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
}
],
"release_date": "2026-08-01T12:22:18.177000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via object serialization bypass"
},
{
"cve": "CVE-2026-73086",
"cwe": {
"id": "CWE-1241",
"name": "Use of Predictable Algorithm in Random Number Generator"
},
"discovery_date": "2026-08-11T17:11:45.607696+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nanoid: nanoid: Predictable ID generation due to integer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "RHBZ#2514175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/3.3.12",
"url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/5.1.11",
"url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
}
],
"release_date": "2026-08-11T16:46:23.024000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nanoid: nanoid: Predictable ID generation due to integer overflow"
}
]
}
RHSA-2026:7224
Vulnerability from csaf_redhat - Published: 2026-04-09 04:58 - Updated: 2026-08-17 19:30Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_tlsext_servername_callback callback function can be used to implement Server Name Indication (SNI) during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can allow an attacker to bypass SNI-based security controls and access restricted endpoints.
5.4 (Medium)
Affected products
Threats
Impact
Moderate
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Threats
Impact
Important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7224",
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27448",
"url": "https://access.redhat.com/security/cve/CVE-2026-27448"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7224.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-08-17T19:30:12+00:00",
"generator": {
"date": "2026-08-17T19:30:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:7224",
"initial_release_date": "2026-04-09T04:58:57+00:00",
"revision_history": [
{
"date": "2026-04-09T04:58:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T19:30:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "pyopenssl-main@src",
"product": {
"name": "pyopenssl-main@src",
"product_id": "pyopenssl-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/pyOpenSSL@26.0.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "pyopenssl-main@noarch",
"product": {
"name": "pyopenssl-main@noarch",
"product_id": "pyopenssl-main@noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/pyOpenSSL-doc@26.0.0-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "pyopenssl-main@noarch as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:pyopenssl-main@noarch"
},
"product_reference": "pyopenssl-main@noarch",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pyopenssl-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:pyopenssl-main@src"
},
"product_reference": "pyopenssl-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"cwe": {
"id": "CWE-636",
"name": "Not Failing Securely (\u0027Failing Open\u0027)"
},
"discovery_date": "2026-03-18T00:02:04.322126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448508"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_tlsext_servername_callback callback function can be used to implement Server Name Indication (SNI) during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can allow an attacker to bypass SNI-based security controls and access restricted endpoints.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_tlsext_servername_callback function. For the handshake to proceed incorrectly, the callback must raise an unhandled exception, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "RHBZ#2448508",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448508"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27448"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27448",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27448"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0",
"url": "https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424"
}
],
"release_date": "2026-03-17T23:24:30.661000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T04:58:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_tlsext_servername_callback function is wrapped in a try/except block. This block should explicitly return a failure code instead of allowing the exception to propagate.",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T04:58:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
}
]
}
RHSA-2026:8437
Vulnerability from csaf_redhat - Published: 2026-04-16 10:43 - Updated: 2026-08-17 19:30Summary
Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency
Severity
Important
Notes
Topic: The GA release of the RHTAS Model Transparency CLI image.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
26 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The GA release of the RHTAS Model Transparency CLI image.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8437",
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8437.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency",
"tracking": {
"current_release_date": "2026-08-17T19:30:13+00:00",
"generator": {
"date": "2026-08-17T19:30:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:8437",
"initial_release_date": "2026-04-16T10:43:56+00:00",
"revision_history": [
{
"date": "2026-04-16T10:43:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T19:30:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product_id": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/model-transparency-rhel9@sha256%3A58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1775815407"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product_id": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product_identification_helper": {
"purl": "pkg:oci/model-transparency-rhel9@sha256%3A66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755?arch=arm64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1775815407"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64"
},
"product_reference": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
},
"product_reference": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
SUSE-SU-2026:1192-1
Vulnerability from csaf_suse - Published: 2026-04-07 08:39 - Updated: 2026-04-07 08:39Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-2026-1192,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1192,SUSE-SLE-Module-Python3-15-SP7-2026-1192,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1192,openSUSE-SLE-15.6-2026-1192
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1192,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1192,SUSE-SLE-Module-Python3-15-SP7-2026-1192,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1192,openSUSE-SLE-15.6-2026-1192",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1192-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1192-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261192-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1192-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045297.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-04-07T08:39:34Z",
"generator": {
"date": "2026-04-07T08:39:34Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1192-1",
"initial_release_date": "2026-04-07T08:39:34Z",
"revision_history": [
{
"date": "2026-04-07T08:39:34Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"product": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"product_id": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-python3:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Python 3 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T08:39:34Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T08:39:34Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:20930-1
Vulnerability from csaf_suse - Published: 2026-03-25 03:41 - Updated: 2026-03-25 03:41Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-SLES-16.0-439
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-439",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20930-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20930-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620930-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20930-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045222.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-03-25T03:41:42Z",
"generator": {
"date": "2026-03-25T03:41:42Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20930-1",
"initial_release_date": "2026-03-25T03:41:42Z",
"revision_history": [
{
"date": "2026-03-25T03:41:42Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"product": {
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"product_id": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
},
"product_reference": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
},
"product_reference": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-25T03:41:42Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-25T03:41:42Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:20954-1
Vulnerability from csaf_suse - Published: 2026-04-01 09:35 - Updated: 2026-04-01 09:35Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-SLE-Micro-6.1-467
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-467",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20954-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20954-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620954-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20954-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045285.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-04-01T09:35:43Z",
"generator": {
"date": "2026-04-01T09:35:43Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20954-1",
"initial_release_date": "2026-04-01T09:35:43Z",
"revision_history": [
{
"date": "2026-04-01T09:35:43Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch",
"product": {
"name": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch",
"product_id": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
},
"product_reference": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T09:35:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T09:35:43Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:20960-1
Vulnerability from csaf_suse - Published: 2026-04-01 10:05 - Updated: 2026-04-01 10:05Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-SLE-Micro-6.0-649
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-649",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20960-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20960-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620960-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20960-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045279.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-04-01T10:05:58Z",
"generator": {
"date": "2026-04-01T10:05:58Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20960-1",
"initial_release_date": "2026-04-01T10:05:58Z",
"revision_history": [
{
"date": "2026-04-01T10:05:58Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-pyOpenSSL-24.0.0-2.1.noarch",
"product": {
"name": "python311-pyOpenSSL-24.0.0-2.1.noarch",
"product_id": "python311-pyOpenSSL-24.0.0-2.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-24.0.0-2.1.noarch as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
},
"product_reference": "python311-pyOpenSSL-24.0.0-2.1.noarch",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T10:05:58Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T10:05:58Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:21990-1
Vulnerability from csaf_suse - Published: 2026-06-03 12:33 - Updated: 2026-06-03 12:33Summary
Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt
Severity
Important
Notes
Title of the patch: Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt
Description of the patch: This update fixes the following issues:
golang-github-prometheus-node_exporter:
- Version 1.10.2:
* meminfo: Fix typo in Zswap metric name
- Version 1.10.1:
* filesystem: Fix mount points being collected multiple
times
* filesystem: Refactor mountinfo parsing (bsc#1261810)
* meminfo: Add Zswap/Zswapped metrics
- Version 1.10.0:
* Changes:
+ mdadm: Use sysfs for RAID metrics
+ filesystem: Add erofs in default excluded fs
+ tcpstat: Use std lib binary.NativeEndian
* New Features:
+ pcidevice: Add new collector for PCIe devices
+ AIX: Add more metrics
+ systemd: Add Virtualization metrics
+ swaps: Add new collector
* Enhancements:
+ wifi: Add packet received and transmitted metrics
+ filesystem: Take super options into account for read-only
+ pcidevice: Add additional metrics
+ perf: Add tlb_data metrics
* Bugs fixed:
+ interrupts: Fix OpenBSD interrupt device parsing
+ diskstats: Simplify condition
+ thermal: Sanitize darwin thermal strings
+ filesystem: Fix Darwin collector cgo memory leak
+ cpufreq: Fix: collector enable
+ ethtool: Fix returning 0 for sanitized metrics
+ netdev: Fix Darwin netdev i/o bytes metric
+ systemd: Fix logging race
+ filesystem: Fix duplicate Darwin CGO import
salt:
- Security issues fixed:
- CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service
(bsc#1259554)
- Other updates and bugfixes:
- Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Hardened Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Fixed testsuite failures
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fixed ansible.playbooks extra-vars quoting (bsc#1257831)
- Fixed virtualenv call in test helper to use proper python version
uyuni-tools:
- Version 0.1.39-0:
- mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)
- Fixed default value for helm registry (bsc#1258927).
- Use static supportconfig name to avoid dynamic search
(bsc#1257941)
- Do not nest multiple tarball files and instead collect
all files into one tarball (bsc#1252964)
- Show where final tarball was generated (bsc#1259208)
venv-salt-minion:
- Security issues fixed:
- CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service
(bsc#1259554)
- CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
- CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)
- Other updates and bugfixes:
- Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Hardened Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Make users with backslash work for `salt-ssh` (bsc#1254629).
- Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),
- Fixed `virtualenv` call in test helper to use proper Python version.
- Fixed the issue preventing SELinux profile to be loaded on SLES 16
deployed using cloud images (bsc#1258957)
Patchnames: SUSE-SLE-Micro-6.0-740
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x | — |
Vendor Fix
|
Threats
Impact
important
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\ngolang-github-prometheus-node_exporter:\n\n- Version 1.10.2:\n\n * meminfo: Fix typo in Zswap metric name\n\n- Version 1.10.1:\n\n * filesystem: Fix mount points being collected multiple\n times\n * filesystem: Refactor mountinfo parsing (bsc#1261810)\n * meminfo: Add Zswap/Zswapped metrics\n\n- Version 1.10.0:\n\n * Changes:\n\n + mdadm: Use sysfs for RAID metrics\n + filesystem: Add erofs in default excluded fs\n + tcpstat: Use std lib binary.NativeEndian\n\n * New Features:\n\n + pcidevice: Add new collector for PCIe devices\n + AIX: Add more metrics\n + systemd: Add Virtualization metrics\n + swaps: Add new collector\n\n * Enhancements:\n\n + wifi: Add packet received and transmitted metrics\n + filesystem: Take super options into account for read-only\n + pcidevice: Add additional metrics\n + perf: Add tlb_data metrics\n\n * Bugs fixed:\n\n + interrupts: Fix OpenBSD interrupt device parsing\n + diskstats: Simplify condition\n + thermal: Sanitize darwin thermal strings\n + filesystem: Fix Darwin collector cgo memory leak\n + cpufreq: Fix: collector enable\n + ethtool: Fix returning 0 for sanitized metrics\n + netdev: Fix Darwin netdev i/o bytes metric\n + systemd: Fix logging race\n + filesystem: Fix duplicate Darwin CGO import\n\nsalt:\n\n- Security issues fixed:\n\n - CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service\n (bsc#1259554)\n\n- Other updates and bugfixes:\n\n - Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n - Hardened Tornado from invalid HTTP reason phrases\n - Read full URI from ldap pillar config (bsc#1254900)\n - Fixed testsuite failures\n - Make users with backslash working for salt-ssh (bsc#1254629)\n - Fixed ansible.playbooks extra-vars quoting (bsc#1257831)\n - Fixed virtualenv call in test helper to use proper python version\n\nuyuni-tools:\n\n- Version 0.1.39-0:\n\n - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)\n - Fixed default value for helm registry (bsc#1258927).\n - Use static supportconfig name to avoid dynamic search\n (bsc#1257941)\n - Do not nest multiple tarball files and instead collect\n all files into one tarball (bsc#1252964)\n - Show where final tarball was generated (bsc#1259208)\n\nvenv-salt-minion:\n\n- Security issues fixed:\n\n - CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service\n (bsc#1259554)\n - CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)\n - CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)\n\n- Other updates and bugfixes:\n\n - Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n - Hardened Tornado from invalid HTTP reason phrases\n - Read full URI from ldap pillar config (bsc#1254900)\n - Make users with backslash work for `salt-ssh` (bsc#1254629).\n - Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),\n - Fixed `virtualenv` call in test helper to use proper Python version.\n - Fixed the issue preventing SELinux profile to be loaded on SLES 16\n deployed using cloud images (bsc#1258957)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-740",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21990-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:21990-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621990-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:21990-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047107.html"
},
{
"category": "self",
"summary": "SUSE Bug 1252964",
"url": "https://bugzilla.suse.com/1252964"
},
{
"category": "self",
"summary": "SUSE Bug 1254619",
"url": "https://bugzilla.suse.com/1254619"
},
{
"category": "self",
"summary": "SUSE Bug 1254629",
"url": "https://bugzilla.suse.com/1254629"
},
{
"category": "self",
"summary": "SUSE Bug 1254900",
"url": "https://bugzilla.suse.com/1254900"
},
{
"category": "self",
"summary": "SUSE Bug 1257583",
"url": "https://bugzilla.suse.com/1257583"
},
{
"category": "self",
"summary": "SUSE Bug 1257831",
"url": "https://bugzilla.suse.com/1257831"
},
{
"category": "self",
"summary": "SUSE Bug 1257941",
"url": "https://bugzilla.suse.com/1257941"
},
{
"category": "self",
"summary": "SUSE Bug 1258927",
"url": "https://bugzilla.suse.com/1258927"
},
{
"category": "self",
"summary": "SUSE Bug 1258957",
"url": "https://bugzilla.suse.com/1258957"
},
{
"category": "self",
"summary": "SUSE Bug 1259208",
"url": "https://bugzilla.suse.com/1259208"
},
{
"category": "self",
"summary": "SUSE Bug 1259554",
"url": "https://bugzilla.suse.com/1259554"
},
{
"category": "self",
"summary": "SUSE Bug 1259700",
"url": "https://bugzilla.suse.com/1259700"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE Bug 1261810",
"url": "https://bugzilla.suse.com/1261810"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31958 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31958/"
}
],
"title": "Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt",
"tracking": {
"current_release_date": "2026-06-03T12:33:42Z",
"generator": {
"date": "2026-06-03T12:33:42Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:21990-1",
"initial_release_date": "2026-06-03T12:33:42Z",
"revision_history": [
{
"date": "2026-06-03T12:33:42Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-salt-3006.0-16.1.aarch64",
"product": {
"name": "python311-salt-3006.0-16.1.aarch64",
"product_id": "python311-salt-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-3006.0-16.1.aarch64",
"product": {
"name": "salt-3006.0-16.1.aarch64",
"product_id": "salt-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-master-3006.0-16.1.aarch64",
"product": {
"name": "salt-master-3006.0-16.1.aarch64",
"product_id": "salt-master-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-minion-3006.0-16.1.aarch64",
"product": {
"name": "salt-minion-3006.0-16.1.aarch64",
"product_id": "salt-minion-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-transactional-update-3006.0-16.1.aarch64",
"product": {
"name": "salt-transactional-update-3006.0-16.1.aarch64",
"product_id": "salt-transactional-update-3006.0-16.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python311-salt-3006.0-16.1.s390x",
"product": {
"name": "python311-salt-3006.0-16.1.s390x",
"product_id": "python311-salt-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-3006.0-16.1.s390x",
"product": {
"name": "salt-3006.0-16.1.s390x",
"product_id": "salt-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-master-3006.0-16.1.s390x",
"product": {
"name": "salt-master-3006.0-16.1.s390x",
"product_id": "salt-master-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-minion-3006.0-16.1.s390x",
"product": {
"name": "salt-minion-3006.0-16.1.s390x",
"product_id": "salt-minion-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-transactional-update-3006.0-16.1.s390x",
"product": {
"name": "salt-transactional-update-3006.0-16.1.s390x",
"product_id": "salt-transactional-update-3006.0-16.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-salt-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64"
},
"product_reference": "python311-salt-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-salt-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x"
},
"product_reference": "python311-salt-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64"
},
"product_reference": "salt-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x"
},
"product_reference": "salt-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-master-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64"
},
"product_reference": "salt-master-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-master-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x"
},
"product_reference": "salt-master-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-minion-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64"
},
"product_reference": "salt-minion-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-minion-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x"
},
"product_reference": "salt-minion-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-transactional-update-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64"
},
"product_reference": "salt-transactional-update-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-transactional-update-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
},
"product_reference": "salt-transactional-update-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T12:33:42Z",
"details": "low"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T12:33:42Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
},
{
"cve": "CVE-2026-31958",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31958"
}
],
"notes": [
{
"category": "general",
"text": "Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31958",
"url": "https://www.suse.com/security/cve/CVE-2026-31958"
},
{
"category": "external",
"summary": "SUSE Bug 1259552 for CVE-2026-31958",
"url": "https://bugzilla.suse.com/1259552"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T12:33:42Z",
"details": "important"
}
],
"title": "CVE-2026-31958"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…