RHSA-2026:1942HighCVSS 8.7

Red Hat Security Advisory: Red Hat Quay 3.15.3

Published
February 4, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (16)

CVE-2025-66506 →CVE-2024-34156 →CVE-2025-12816 →CVE-2025-15284 →CVE-2025-58754 →CVE-2025-59420 →CVE-2025-66471 →CVE-2025-47913 →CVE-2025-58183 →CVE-2025-61729 →CVE-2026-21441 →CVE-2025-47907 →CVE-2025-52881 →CVE-2025-65945 →CVE-2025-66418 →CVE-2026-24049 →

📋 Description

CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-59420 — authlib: Authlib RFC violation CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products23

  • Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:59059b547d81061afa5296c9108100ad0a3b38204c369518079547f53f9fde39_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:c0c2597d756a64d1c337e4b1363237c0d0f0d51a3a4a7e66869d9de8fc107f5c_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:fb914c779ffbacc700738d66a879265eb16f00b93992df9110098fad1260c3ad_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:547045f7298b7f61aadb4078a7f98f09de79ea9a96d15334fb3dced867363799_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:08d2fa1fec592fa0e8adf5f32ea89bfcfef66b9d62fb16c059e0dfa7e30a67cf_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:6549757fb3ab0a938995dee5a585ebea1b993b7a7acec3967814bc4edfe88dc9_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f57d155305428d13516b9952c61a2c0161dca997f6d68f1fb07ed974c5b24e93_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b33074468241b49cd55e104ace159501e5a9c85915e98db7d76414cacc0f9133_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:6cb7b946dc37ba1e17390da5d787cfd13df6060ea0ccf3aef848167069b5771d_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:71bb6e12ef5476df69c02f38d332ff93edec5652c70168250509afa366d35709_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:e657fb1bc3ac18d81475cec98ff2ebaf18c430f580706f8193ccf43cfcba9b32_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:1b029e5ea06245afa565ba026f0aa47e561b2c6d369f466ec445a16f6dbe0c23_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:313b6e898b506c035dbbe58d8b6ef295f4026e9f204983eb72e9e3a63bcefdf0_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6b206358b8b431d0e40ad8cfec4deb98eb65ce154a2975605a7afaaace1ad007_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8b26439b146800cd82f1a83e0d663bbc39cc7fbfc6ed6ce5be8ae0f63abc254a_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-bundle@sha256:197ae6472f0a4fcb33363ed461ea9f465eeff043d88c9d2e27f419f3e68a1a7d_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:50859e911d5bba00742d36bccad895d8951a61cb6d94eccc02c68a6bf760e93c_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:6143158e553f1f0284ec0b41932a03e8aa0c276b54f5bdf9f6bc9c7104215801_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:e51928f87c59cf9226f0debfc91d09683a94a829af498b917d6687fc67f7a916_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:08a827d542790820a10a61bacdc8ab7c05a6fdd476f1224ed76f20d65e93673f_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:7bfb851938e312f47598891ba9f0d7b17e6657090e0204d37d5676313b33f134_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:a8daa359ab7a0bc9722b25fb87aa6fd253506632640bfe7f31c9c92868421ecb_amd64 as a component of Red Hat Quay 3.15

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (19)