RHSA-2026:4185HighCVSS 8.7

Red Hat Security Advisory: Red Hat Quay 3.13.11

Published
March 10, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (10)

CVE-2025-61729 →CVE-2025-66471 →CVE-2025-66506 →CVE-2025-65945 →CVE-2025-66418 →CVE-2026-21441 →CVE-2026-24049 →CVE-2025-12816 →CVE-2025-15284 →CVE-2025-52881 →

📋 Description

CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products32

  • Red Hat Quay 3.13
  • registry.redhat.io/quay/clair-rhel8@sha256:917812ed1960aa5718c3bab783adcb332afe375630cba7943ca22a715fedaffc_ppc64le as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/clair-rhel8@sha256:addfe949914aa4fb9403d1e8c4664bee3f97d1c9cc99de4c9d4a0e77e5d2f399_s390x as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/clair-rhel8@sha256:bb98c2611c6cf222bddd75faf18660d645a2136303cf0daf31cc7b5e0bb7182b_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/clair-rhel8@sha256:f3dc9df30aa3d8112ab0c47900141aa4cdeb4c618f111f091b66d27be9202993_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:bfe38a61bcd4f9e1a74a9b2f681b8713ed4efa553eb40c615fb5ded0aacf24df_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:21094dd4f8766f6fa5ace83e671f85652b72392b18aa21621aa4cd79600d404c_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:25360dfbb6e69528b557f1fbe33a5bde6c37188fc9d1d0d575b2596a8269456f_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fb832f735a69250fa66d90956526222a7e2b64ca0a7f6d09acc582f6527a3ed1_s390x as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:fc369b45e2f0cfafc7da05282474ae813830b012f8032b91d6b8f7d75287d470_ppc64le as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0c811368ef77d8b17e1e27fa273c87dcd4b572635872221a8cb9bdf39ae6fe06_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:8eaf9253428eef927bfa7509f1fbbaf6998e5bd262f0aca2b980863e6f411618_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:af814ef84aa0e649a02ef2877c9ad963e30ee9a1416e30f128c4841d7e53f211_ppc64le as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f0c44916f0e4a0b792e743a8157a014d569dc759fc64657bc3b911f2d1d22ecc_s390x as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:0993ee9ca326a40bdd35828b7f07f9d832d033b99b061ddd046e384285a408b6_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:2ede08e62b85bbbd62b45f892aa5532226b403fbb27ce5ec4ee0e79a65532551_s390x as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:5ee96859a8b4da0eaf09e7c14e032264ec29c7adc2c6826a7365f85313dff3c2_ppc64le as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:d711fca418151140d24632df9f461e6cf72d70cbcc225e42cb3a2d6c695848df_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:61cb5727b7d7ba543c4b6eade2c582960bdd432ff44e060892e7ecd20def4c88_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:740d25ad8aec0139151be72e70a1d12b5f78dc1ee813658bef52578306608d0c_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7a19a5b8796e9c90a6c88859f02c366cc047901b9c0c62a99b2513fbb4d756e1_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:86bd2e921dc9a6ed1afb355a3c8aabd5a385ec91b1d2429a14516e7fde43aa17_s390x as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:ca30d6af7d8923ac5b65fbb74cc06e943c67ea24f2cdaf2a27f9e9c9196728d5_ppc64le as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-operator-bundle@sha256:aa20b724915b4302c8be86874d50df8c32e624a4dcef4f4b90d6e9394f5bb149_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:6ad9da9512951c26a98358939d06785387689089df874ebce49874466903afcc_amd64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:ba2dbd3198ff3b9089bb05fc78dfd2b20b31f1f89b274f99b4d5aec7004c20ea_ppc64le as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:fe1e31fc27a9cf50f168495f9ea08a561f5fb577195691fa4ac6a177d5d36d8c_s390x as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:ff7b37a2d32eda5c7f81111e0bced17cac64d5652e632e5207fb1794836d3a4c_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-rhel8@sha256:1403699a49e9fa2e04fab27f28de244b6e3e631877eb6eddb55b676d3ec44587_arm64 as a component of Red Hat Quay 3.13
  • registry.redhat.io/quay/quay-rhel8@sha256:39cadc6e19d0ea7e86a6b11aa15093d4e7d24bc69be260abed90396f92b4126c_amd64 as a component of Red Hat Quay 3.13
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11358 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (13)