RHSA-2026:4215HighCVSS 8.7

Red Hat Security Advisory: Red Hat Quay 3.14.6

Published
March 10, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (21)

CVE-2022-30187 →CVE-2024-34156 →CVE-2025-50181 →CVE-2025-66471 →CVE-2026-21441 →CVE-2026-24049 →CVE-2024-47081 →CVE-2025-15284 →CVE-2025-47273 →CVE-2025-47913 →CVE-2025-58754 →CVE-2025-66418 →CVE-2025-66506 →CVE-2025-12816 →CVE-2025-52881 →CVE-2025-58183 →CVE-2025-65945 →CVE-2025-45768 →CVE-2025-59420 →CVE-2025-61729 →CVE-2025-61920 →

📋 Description

CVE-2022-30187 — Azure Storage: Azure Storage Library Information Disclosure Vulnerability CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-47081 — requests: Requests vulnerable to .netrc credentials leak via malicious URLs CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-45768 — pyjwt: pyjwt Weak Encryption Vulnerability CVE-2025-47273 — setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-50181 — urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-59420 — authlib: Authlib RFC violation CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61920 — authlib: Authlib Denial of Service CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products32

  • Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:1ec5bd4c50f080096a3579e498ac9301acf3927834f7773996911db8e11d2279_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:698a1ae2e5e2669d5a328d99deb4b8c67f2d7dd03d878600ce13f8dfb154fcf6_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:a4037bacb4f26a947e511da97519fe318b986e31ef4689a2ec7499789096dc2b_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/clair-rhel8@sha256:aad14ca0de55666d13c1a12511cea2c071d0a1c7c5e1b9ed9d7c70d157225293_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:c4133c994168c764a87f34a39a2fa66fa0c04c0c186781cf024e5e41f62280d0_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1ff62272e3139cfc7abf3511e706bcdffeabfbbcacfee18508bd629cea20fd78_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2f0c540c7269e27be3e0d4f988a4d19371a80b8b0684cff74d21851608636c88_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:aa1b44b1ee74a3ba6aa63eef2003077b1a9a5c067a6aa590eeb8fe30a93fe60b_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:c33a90cf0b733a8fd0514f9c6cd53c22ff307c15b80c582736ab88ed26e967f7_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0a79d63a51f959c7704662cf7370da2bd76cc22dd13acefe6eebe6b38881f98a_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:9e2fd6eb656ea932d83f001922aa46e7cef7796c404dbe7ab6393820149941a8_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bec2f493457c5fec6af7309d9cc09c4a04632b9050b03720861cb05ac77d1d10_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:fd57da947aee5538acc22c9bbc537eeed955334f7bcce8683fe6eb325847812f_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:00c8d4e64fd7246b51a23807d56421a63c5cb201565e50fcdd70623d208b4c80_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:47b66c0f25e0be3b5e533422d5591baadc5f7653ec4c97d8398d6cc3451f5ed9_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:78d3fada736cdb40efb692c6eede03c9a380e3d44e3b4ca338bf3676e1c1b745_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:aea11bfd317b3c0d414f7c1ca5c7768ebbe2bf984d48f2960ec309463c383ced_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:a7f0bcbf21692be996d8beba4228d51d047237a3dad43a5d61e1a379742b5101_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:14d025b088b84df61332fd60382161cccfae6fc7310cdd7fd0a96432a1dcbb0b_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:191c87e2d307ccc97699cf0ff4b7217ca6d4c6fd51b01e93abc423b7b3b688ba_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:19afededc1a3f54a6c3d85c4e0e35043e1b0d2074f0d983e3393c4694348ae58_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:7a15aecd0b757726ec8dd1fc2d8d0e611fba1b77ce7857604bfa56314bc5189a_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-bundle@sha256:ef354fd2be18bcce59d2880843ad295ac8610c1d2dd1565a941ab18e77eec27e_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:420be03e698e066bbaa96c7334e1a6b14793836f437b53ee1d961414115622c4_s390x as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:6e421e848fac1ffd749e1761acd51d41419d73a55e610170e3c6c53294ec061e_amd64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:7d3344ce19373fdf5cc721f0abbb2c2ee87d079b96d0dd4c7350621cfa57a322_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:91844fb97cac49e78054bd9547222aadf1762f1c0fd05feb0b86f9d94787512b_ppc64le as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-rhel8@sha256:05cc4b4410de27e32897492effb21362d8c1bc8cc56e9408fc9a19f9f3149899_arm64 as a component of Red Hat Quay 3.14
  • registry.redhat.io/quay/quay-rhel8@sha256:225e2bed98b80e753ba2eca6b121a7295b20633b25b8098b7dce66efc2bc1b70_amd64 as a component of Red Hat Quay 3.14
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11458 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Users unable to upgrade may manually enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.

🔗 References (24)