RHSA-2026:1730HighCVSS 8.7

Red Hat Security Advisory: Red Hat Quay 3.12.13

Published
February 2, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (12)

CVE-2025-66418 →CVE-2025-66471 →CVE-2025-66506 →CVE-2025-12816 →CVE-2025-15284 →CVE-2025-66031 →CVE-2026-21441 →CVE-2024-34156 →CVE-2024-45337 →CVE-2024-45338 →CVE-2025-52881 →CVE-2025-65945 →

📋 Description

CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66031 — node-forge: node-forge ASN.1 Unbounded Recursion CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products32

  • Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:056dc564e4f8ee5ee816c008b962ca6e2de3b3e86c60fd2805654b6054948caa_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:24eeadd822f6f30c5e587e9d3eba06f1856a2c2e9f47daf4bad706146f50382a_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:338cd06dcc742eb7f37b3ca02ff6c5902630e1466ce3dc6b73b49c1b2b8562fa_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:92e8d6d910fa92fb05e4e0a8046b03090643509fe2a67f8efc8e1bb2b93aba10_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:edc72269317914b4612ffe859a558a886b5a244d99c016896b126f1dd35fb299_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:11c27678e7d181621669548757d07cc9ed5be4e55043d4676fd4a2fb41433498_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f9c64d9e2b9c6c1ae2fc5d00c83498a9bb8db3a0cf5fd3545a49cce65a998ef_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:cc4a64957a3e97ee564e895c50d451dd0cd472ea635a258db2ea3a0bac83e242_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e8980b92b3c6c5fe6cb076121faba33f0c70bb980e349172c0d3732c52ab8c09_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:47e327e54e2dfd7b990a196e8864262ff2ce94e760caa96a163f44fb51119f18_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:a1f93c08e02b3b2651f50bcdb8297a66a4f8a5221284f30c9a3a65a14784c824_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cd984016e01cde762b5958b8e7f8ea9f17828348104f074424a3ed14604a2544_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ed9b563d9a2133239537b37954bbba96ba6e17f9f64d899cfd51688b9bed040a_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:3b19f8efe886a379fcad216b583de6c962a231159020f363323d531c330350de_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:53c55f81a10b84f6c7756a98c30f6c018736d8691440408ded75a9d60d20abd7_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:907981736598e7544bebfc8d174fea92cc9a7769d649cbe8ce3cc296e6953856_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:f2f9b7f06fe1847d49a1d94069e1052b021f2169fb036f2b886f2f70859914de_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:d6728285a5552f62e96c93eb5b0eba181582890c4fce1a0b56758d2b3c4bbdcd_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:39a26364fc2794512c6862fd0333df158d8301ca82eabf53959561fc39fbbe0f_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:412a23db39debcda082d6d85807a7983aa474e3eea8f6780c619d0b371af16ae_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5e8ae98348f50d6a50ff31a3b099afb84109ea0892b9408d16f6f32b0b657048_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:63e2f0159c3521ea5d908f331979836af72c32f18104bcf915feab123e294dd1_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-bundle@sha256:6e048b97ef55a2ad081250608152c08613075713d9b10d7558becfb19ded8e45_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:19951763d79334b5e566c8d9b5acf9524268d1e5864a574632363cf540678184_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:86224e8f5d9f5ede57e90166cde9802c1ef956737b711935b9269b387ea5b68b_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:f2c4a003335692f84e68cb660d61581a68c89607ec92fca9ca08a7e98efc8c63_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:f5050789c44ce9c4de52aa34acf375efe97708a313280e395e34a6d306e5d1e0_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-rhel8@sha256:03a485b1c02f5155f22c7820c166889b3f7d7b479892bb4d106432fa2dbf217b_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-rhel8@sha256:117876c6c6a12beb25983da60c8c1628f350a1797888b9f03c44b9dd737844fa_amd64 as a component of Red Hat Quay 3.12
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)