RHBA-2025:7674HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.14.1 bug fix release

Published
May 15, 2025
Last Modified
August 18, 2026

🔗 CVE IDs covered (3)

CVE-2025-22868 →CVE-2025-22869 →CVE-2025-27516 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:0f3abf42a6d0477d38aebb01145b2958239f8086b32a1d995a13c4148b200e00_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:180f5a0e95e8b3007d62de998d0b5c07acf98077eb2ef60653164a57c01493e6_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:f3bba797e4ef9e5f53ce7f0df622fd1f7b18f33af78b5d8e4f14e98cec803ab7_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:481162609427b823920c93a8c3f62a8eec97b29103c9525546d943a77c2e3f88_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:7a0cd9ec44d5a411eb7e8230c3121425d64ef06a8d2ee2ab549f5830966cf525_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:d783dc9ca701f4d06550c11274ae432b70c827dd6dfc0cd53083112ab2c934cb_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:6194c2cb93e3a64a84f50aa071b0bdb437402dd505aedf1428be358a4abcffb4_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:76351f73fbd6ce2cf9c372f2b3b3b7b5104bf905782b2ad38ee27fb2b9891799_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:b4e4aa556edf6eaa97807a31966b8abab3027000a63dcdc051f77b7f6aa1b576_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:22ad43f75e0b44a9b4b6146b226790525c6ddb04391fe4e0be726d3e9c56e334_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:960a918825b0b3044632e1412e46521cbb45f0ee96fa27a4878145e6b6758710_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:fea1e37a197bab995cee470bf474c85126d32bc992ae61ac36b3f1c732da0526_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:3436d331e245c7717e850551ca0a75ef0946cb1de7a60b49e75c331ed2b4bfcf_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:7196db2e7812fbe818cad31d559a96e42f0444eb5b73cd2f492746da2826eb72_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:79a0edb096c22f3da3b7ce842b0096478e0f4b03a0f0f3d45e3376be44725edf_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:123de7077d1e312028e43276994c0241b6ab7fd6c90529749f1aebac5ecd84eb_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:55a0afe2d4ffd72f4d1fddadbea280941c020e741acbfa6a5152c3331b130714_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:e3c4f6573426071004afd6112f14eaf528c735517e4e24408069c7e221c5aa59_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:4e412ed2ffc7cbf3eb58fbab93e87e13653cabd010e14b902ce2e36adae0bf30_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:5ea9148cddc8cea3a54876b75871f010716888f0afe63e5699dc4363ec32d5e2_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:f4ecbbf9355ec0cc9b49aaefd30d21ca9fe0372a72f17bac5b3eb6207b5a9c84_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:29f32df896c9916f853f4d33e0fd411b5662e7bb2e2e9bad414afbcaa096a75a_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:b71cd8c82f6915578b9d4a0ecc86c4dcc3e8dbc9cbafe199320971019b1850eb_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:d9fc5df956f8c6eadee8bffe5c87f39046c3aba12d27b94a230ee3d95f1bb4ce_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:62e4e9704df33a38978ae53093a00d6d3dd1ec52d948847258efa071907fa89d_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:6389a934229c9677067d1540b98fa73bb25b44e704abc6634a2ba305439c9899_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:75dc27fc000f1008eb1a52aee371c5e327e44464014f44d31ce56bba41e9288a_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:07b14d30216cdda2282e266bfda2b05e42483eb7da3dec2bc3f72a7b55719d87_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:88f934345fe6f98db6469acadaee891f7a106151b3a4b9ead4530043a230b3dc_s390x as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers.

🔗 References (9)