RHSA-2026:22840HighCVSS 8.2

Red Hat Security Advisory: Red Hat Quay 3.10.22

Published
June 3, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (19)

CVE-2026-40895 →CVE-2026-42041 →CVE-2026-32282 →CVE-2026-33894 →CVE-2026-42043 →CVE-2026-32280 →CVE-2026-32589 →CVE-2026-40192 →CVE-2026-42033 →CVE-2026-42039 →CVE-2025-62718 →CVE-2026-2377 →CVE-2026-32281 →CVE-2026-32590 →CVE-2026-42035 →CVE-2026-42044 →CVE-2026-4598 →CVE-2026-34986 →CVE-2026-39892 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-2377 — mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality CVE-2026-4598 — jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32589 — mirror-registry: quay: insecure direct object reference in BlobUpload CVE-2026-32590 — mirror-registry: remote code execution using pickle deserialization CVE-2026-33894 — node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39892 — cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API CVE-2026-40192 — Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products23

  • Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:0a19dd61567ff1df5d315a1a5028e28a8917677c946f352a3b4ebe15275e95d6_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:2458e97873fa8ce44c2cfdba91ed2218b7c8eb81a56f45e8df196aafaf7bc778_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:56d1619e0a47be2d43654b16e40ea1b3a9f327853a91f1bb5226af758fb4ea2f_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:fa9f687779e18fdf4b2bb37f430a901602b86063f068f5deda6188478a295554_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a7491a272b7d1c67ae910e097f60a69d9ff961301f6d6313a392df126ff41fdc_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bcf7d7cf2f8421b2851df76ababedaf45fae3321d5ca60511e88f14ba5d3941c_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e4b3de8a5e61bd32a21c8c2d88a98fbf9e9491dd30cdfc404078922602273729_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7f21e78fc22ab49b37b55f28e2a5fa37e913684714943e46d87cd5a2cebf54a6_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:14503039a9b2f1b9f3de23c8d96f2a8cb55c2562b9fccb06ed6367e765f2a744_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:c9c4462d0badea29c857d1dfcb3883e2cb2cf16bf8333358e53590640a575615_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:ff9d20e3f323570cfc23c32cba22fdb6ab0ea79e9ebdce379c5f36ccfd132d3d_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6171d21593edfd320b55fb27381e5fb16cb98ee77f37bbf51da755c99727a253_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:307f5a05a9ba2aa489976f588c033c60c0f8bf2a959cd68e19d2e20c61ac4ff1_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:57156c76f32d6acb0edb09be7b8aef028b1b0499a3e954d759a636985fcd1502_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c198be8391f2883cccae06f39604f2f61aa557cd51a99a22187b2fe3bee0590c_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-bundle@sha256:76f2d738af0c5413dd5a9f79f39582e5d9e8b512f0bda0151a307ef7fdc436f8_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:c177bf11278087349290197f3dbc470cf0ade6be3705e0290ce4294637b17099_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:e2701d2b3c5170d096c97006aff96cc50b6106eb4467b12faed889b4f30d5309_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:f8b0d7b978589b98c423c86d99a4f2b8f34f8884177c3703c19ee1bf5f8eb4d6_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:5fda9676baf87c3bbcbf4cc37588b4d0f2c24f1be36fec0d90afe044f673c5dc_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:a1c0a72df841fd97f7def41b3de85bfd7ceaa809805bebf3291ba54345bda7a1_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:c068b508acb9777d4cbacec4c6bd451b2858786ac4bfa249a1575f993efb7cb5_ppc64le as a component of Red Hat Quay 3.1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (22)