RHSA-2026:23361HighCVSS 8.2

Red Hat Security Advisory: Red Hat Quay 3.9.22

Published
June 4, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (22)

CVE-2026-4598 →CVE-2026-32282 →CVE-2026-32590 →CVE-2026-33894 →CVE-2026-42041 →CVE-2026-2377 →CVE-2026-4427 · pendingCVE-2026-40192 →CVE-2026-42043 →CVE-2026-42044 →CVE-2025-61726 →CVE-2025-62718 →CVE-2026-32281 →CVE-2026-32589 →CVE-2026-39892 →CVE-2025-61728 →CVE-2026-32280 →CVE-2026-34986 →CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42035 →CVE-2026-42039 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-2377 — mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality CVE-2026-4427 — github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message CVE-2026-4598 — jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32589 — mirror-registry: quay: insecure direct object reference in BlobUpload CVE-2026-32590 — mirror-registry: remote code execution using pickle deserialization CVE-2026-33894 — node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39892 — cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API CVE-2026-40192 — Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products23

  • Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:0b0ecd3a428dece445d557be19d0996b6ac9d6bb6da31afdb7421bc9939611b2_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:1b7667a1d8270eb378a553a47e2002ea8a1d6273a85774ecd43a7942ea2a9390_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:ff1876083ba67b1ba5b29f8e186a4f8409083c7939607ebb65866e7a1cb39bbe_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:086d403e42c9ef583f6a3cd8a5a1169967085ebf764376e53f1a4f013cf14b6d_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54f11bcca5d5ae3f68670136447d2072ac8c0d7bf2711f0f73df7fd50e70f537_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:56b5da889ae2dd8fa359ac965a47d5e54942748de4c1506d18081fe8e5639424_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5e980b6d4a08d3aa8851c3402eccfecd9cd71c73bce187a7c8e131d0ff3d480b_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:499887bb396966300a42f61f1f70450d9e726d78737e6b8346e8fc64336d5e9f_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:39b151d9d7f16612535c6f49e2618f7adeaac6ba9988b76e2cbc4361ee7cd80c_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:3a2c4cdcfb18d07736c6a7e890fc07c664cd2c343d7eaa566552149b860a471e_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:dd303901b2b6ad736407e0fabcf6a70cac9fe9fe1976a89e2e53570fcbacf17d_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:8c7d45b2b41967720762c47cace1a1467c770e310e840c66de140da510e6f7bc_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9ad3688f341e892ef223c2029edc9502ee4d6b2687871370a442f6951f7bb4f0_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f5305c63f44d84776243024a9c73e7939d5e5280bbebd17bec78610fc09b078_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b20353ac757b01c006989ac9c109341e95278b5c22b6432fdfe9588583b9c9f5_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-bundle@sha256:8dd0d4412f7db90bd986f2f2c25016494a0027a2a9ea0d72657843429e448793_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:5dbc5ef200e2c26c8fe6e8b82d0223f06987972f19bf94e333f30faded46657b_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:e7330d260bb74ead476d4ff45607bc78d87a518d311f6a874bb9e5f38be3b40e_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:e89ae6e88f763af3ebf269c2cf41ef4cdf248e532cc4266f608b943cefbd8b2d_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:213950327c209a8132eabba4de3dc940cd15f5a5d5ae7efd2b75c3c08c06a682_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:cc7110e65ef4d9ec5d3f19741e973318bd8699059886e4514015a228365256bb_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:e43d2243b0ec9c5875b3bfe44cc2507c0b5e0226afa94662b98cbadcc0d220b6_amd64 as a component of Red Hat Quay 3.9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (25)