RHSA-2026:24853HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.15.5

Published
June 9, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (23)

CVE-2026-4427 · pendingCVE-2026-25679 →CVE-2026-32590 →CVE-2026-34986 →CVE-2026-40192 →CVE-2026-42044 →CVE-2026-27962 →CVE-2026-32280 →CVE-2026-32286 →CVE-2026-32589 →CVE-2026-33186 →CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42039 →CVE-2026-2377 →CVE-2026-27459 →CVE-2026-32282 →CVE-2026-33894 →CVE-2026-39892 →CVE-2026-42035 →CVE-2026-42041 →CVE-2026-42043 →CVE-2025-62718 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-2377 — mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality CVE-2026-4427 — github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27459 — pyOpenSSL: DTLS cookie callback buffer overflow CVE-2026-27962 — authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-32589 — mirror-registry: quay: insecure direct object reference in BlobUpload CVE-2026-32590 — mirror-registry: remote code execution using pickle deserialization CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33894 — node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39892 — cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API CVE-2026-40192 — Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products23

  • Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 as a component of Red Hat Quay 3.15

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (26)