RHSA-2025:23061HighCVSS 8.2

Red Hat Security Advisory: Red Hat Quay 3.9.17

Published
December 10, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (6)

CVE-2024-45338 →CVE-2025-47913 →CVE-2025-59420 →CVE-2025-61920 →CVE-2024-34156 →CVE-2024-45337 →

📋 Description

CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-59420 — authlib: Authlib RFC violation CVE-2025-61920 — authlib: Authlib Denial of Service

🎯 Affected products32

  • Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:02ced94ebfcce3e21bcc71af6aa1c11db50822c91dd05cec4fb41a34e6669112_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:42a67bb2e5ab681eadc253b413f0bf557d63f282f270e6064f5768fecf6886e5_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:880c746eb5822f68e41ca7b60d97799115c30f39bdc7e458f7a4101e2af36c8c_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:ad995b723102f4472e4190257b61582de5c6b058b908bcee7cebe683ae77be75_arm64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:7db467404171294d793ef0fd1a59fd6e5bd20ed8915913a1edf013d18e4c9a78_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1deefc2cd91d0f2c474eda0fbb81bbce30786754d8fb9100b73823fae9562a40_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b0b66c3c98a91dc4d4e1e0dd1b2fa58b542b02e27ba283cd5d90b7758ebfaf21_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ddbf02cbfae810853f79628b576abcd0276f27ef27ad07a92f71df93a339cb4a_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f78eef52e9365e9e2beb65496840748f00d6b6f662da50bbf48b9c695369b359_arm64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:47e21d3d9c9ee2de4a1e557e32521f64db2098b9f4dcd32e0d6f4d0962be7993_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:69806c46f3439bd780533b2660726a95c8acbff0986e340b040f1fb333e5feaf_arm64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:88724eda5d52df59f156b7d318f69c79540faddb41bb770b7f56394fd76ba5e1_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:e701896ef9c36202581832d3dd9413f99c94ab7da435f7afb91c9e0ffe2e20ae_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:118676c250f94b51d2484414190933c1d8fa61605cef0deff2aab6527f783d73_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:5f883757f060b68dfd010f125d31556df3d29c129de088c257debd8239cf7d40_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:a9cbc8c21b24b5a534de5e553040b13d7d02dcb7ebf23d35019a65a253825bb6_arm64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:c644998824e04ecf279deae25a22cce6c48d8bca44755f76eb4abacf17052519_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:00dc04b86ae7fd7dd37e9234ed2b4a1d0f0403993c153e197ac8b96233e95048_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:385004b2d63a6fee322819b91d7d1df2368742b75a88960f9a43adb5a3727ac0_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:795bd464d6825f905679d1ad504d7e4f5c6291f89706f3b78c41bc6776522805_arm64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b3fc7bb5b6912f68e9b3422eb2f3ad072f0cd8ff412c5b56b9879fd4a6f3f78c_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:cc9d5c2de42541033a2c01aeb385404058cdac60a8cd2fd9889f7d73cdbc6292_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-bundle@sha256:3c1f25918b505ec71eaf93d2a0b963d209e36d847e7fc48469f9d40b534344ae_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:02fa492e51729469aaf4e106ad4fbfbf8bfeb63fd51b668782825a4f0ef10194_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:1230d53c9bf30d0ef730a403012530c0bf654d597b164687911524f8b5085eac_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:6d831031c1e4cdc251236b241e4a15b7152900d75fb0bee8bdd39610e249a53b_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:ce4e7a55f2d6768340bf5d13b3b60e61c3d1a783ec338f591dd56003e665895e_arm64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:1cb5d4a87d8bd300edace58d2f3658e1296a23c0d4fed13fd0baa2fdb1da27d8_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:1e95647d265fcc668bb66cc83fff56eb00eb2a7a4c8a7a2d86186bdc68de3ea0_ppc64le as a component of Red Hat Quay 3.9
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Users unable to upgrade may manually enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.

🔗 References (9)