RHSA-2026:2681HighCVSS 8.2

Red Hat Security Advisory: Red Hat Quay 3.16.2

Published
February 12, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (13)

CVE-2025-66418 →CVE-2024-34156 →CVE-2025-15284 →CVE-2025-61726 →CVE-2025-61729 →CVE-2025-66471 →CVE-2026-21441 →CVE-2026-24049 →CVE-2024-45337 →CVE-2024-45338 →CVE-2025-31133 →CVE-2025-52881 →CVE-2025-65945 →

📋 Description

CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-31133 — runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products24

  • Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:9784029a9d44a605dd28583416a7322c84189f4ee8e1bfa1be822d9260639d35_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:afe2137c2002e07f27b105b9db90030ca0f3347a038ab8418d257dabe7aefcd1_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:bf85b1b91bcbaea8cb0fc021d1f590ba3da4e0b2f8703cb449791ece5930d68c_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:dda553368706ad66215cc95b9b0306808531b0ed92b7dc7880cd2c95f8e0faed_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:3b252ccf24df27ea02a005d734eb501abf989b97b5d9e3ff57aa3b7e9633f165_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:5eb5f4aafd4fa3b53c6477424946f743bf5236ac434ddffa8a887a26a47e0fab_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:c96f472d44fff765175c4ee77ddb94bfac580105900f5e21274e959099bb97fa_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:6ac48cf92c9bb3d6eac9645ef203bcd2e475da36c182eed9ceadc3490e77a042_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:146699ff1cd4f8fdf19594ad5ce11dcafe9f8a266c94b104826c871b675f92e1_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:76354449e4e8b67bfbbfae10337b7d50fc657c909c8798fddb95dee408c3a9f2_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:8166562a51177faff8e520980153e1760a4863417a824ac15deb4314afcf1925_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:77387c33232561396c8826a393d17771bf88aaad90436c4e1e5aa36891840b16_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:1f03a49fec5f575e98c3f37ee081d5510a87172e72bc66627f935314d11a67c4_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:9969081b9da11f5a56d3ebf9ccd9428d9d59741c058abe4510e7ae3375a11519_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e3ab3a505d3d08f7bad3c899f40727e2de524cd14c4c44b00f44b7b42f7ddd21_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-bundle@sha256:fa64c1d47fc10d14120ec9e7afc2e253620fdc28592f4d859350db4fbdf0fae2_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:64adacf9cccd05601f4a7b38a7cd55d55291583dc9d33e4cfd1e4fd426cd0936_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:8a1b8eedcb8e36ddfb1982062ad379c4f65f95260545d05d0cf10918427089d8_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:bbbd11d9b959ef12ae61a7975ffb08541797b0fad2d098781ec4543fd4ac2893_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:35e3dc29e64bae8c0b35d7884281397c58165a5b145676919452a02b9f56ee4c_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:45de5fc478cb2734b672630c67ffee4e6b98954848b97ea9a1cc9903a53dbf8e_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:96588daff01f27db2ee335dcd957e9dec7f38a2c573e2968d9bc5835edc2957b_arm64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:9f58fc80db29fa44684c6e39bb2eda06e86ba34801d5e04468941ac8d0b754eb_ppc64le as a component of Red Hat Quay 3.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Potential mitigations for this issue include: * Using user namespaces, with the host root user not mapped into the container's namespace. procfs file permissions are managed using Unix DAC and thus user namespaces stop a container process from being able to write to them. * Not running as a root user in the container (this includes disabling setuid binaries with noNewPrivileges). As above, procfs file permissions are managed using Unix DAC and thus non-root users cannot write to them. * Depending on the maskedPath configuration (the default configuratio nonly masks paths in /proc and /sys), using an AppArmor that blocks unexpectedwrites to any maskedPaths (as is the case with the defaultprofile used by Docker and Podman) will block attempts to exploit this issue. However, CVE-2025-52881 allows an attacker to bypass LSMlabels, and so this mitigation is not helpful when considered incombination with CVE-2025-52881. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)