RHSA-2026:5168HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.9.19

Published
March 19, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (10)

CVE-2026-25639 →CVE-2026-25990 →CVE-2026-26007 →CVE-2026-27904 →CVE-2025-61726 →CVE-2025-68121 →CVE-2025-69873 →CVE-2026-26996 →CVE-2026-27628 →CVE-2026-28802 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27628 — pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-28802 — authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access

🎯 Affected products23

  • Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:0793761b8f52bd37b70a0920c123df7b5689050fe0d0b180a23747382136805d_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:2c4942e97dbe11310a36b234b6b79248aa901521c0cc6ede26c264852cc1c6c7_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/clair-rhel8@sha256:e16ff32fc51fc8515f0798b9b0facfae3b18e11d1c200ad561c5f96c4591e748_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:1f6d8b0bf693a4ff88c2e5f8fe5a39ce306243eb60670272f31b1ce0784355d5_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1c162f16e74dff074693cb2c1629fa10fcbdda7e297305c505c3eadbbb6fd253_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ca15dc9c0af98219cf20368b4fb1d7f5e79a72112446b3cb2bc29d0950a4a614_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce8008cf1e109a6109802654da56c24a94b436a15d68cac2fc7154e955ea60c3_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:24860b370a6bd80d71b174736e21690cc3360b7e03eba42a7e9b6ee0f8e513f1_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:591ecd8de762d2064ff254bb0ab87c7f67fc2feda462dfc91386cec7fb58be59_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:6e208ffe402a0a2fef67414ce3c23849129054b4d58285eaecb5d7511b4a8a94_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:cb97c36edb2dbd26a82a421316b2d78694b58b446e03fc9770225a238b6ac65f_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3443ae24c14bfe47730a8c9d80478948df7364eb5a11c031537d6a1ec39aac8d_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6a0081cc99c6fcf508090727ac8690b72d455a506866ae0279d19119098ea7da_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:85c2ef5ae8e143f76831e6231c420fa1d9fd0ea237dfd1bce7d6751b09203dd0_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d97a9d9d6da4388e61873bf60413a321be153e2a9d19031fa885bcc69540afc6_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-bundle@sha256:7363defd98566b083b35c27715a53bc5bfbcbd73fa9dafe7a6218166e9d11b14_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:32a95ce56a8ac04a8fd37eab9ff385d4042d53e533f5bba8e5592faeb09f01fc_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:a6f6ea5303d254e481143d95ab41d05a7ce31a321ca787893eba35dbd75e6caf_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:f5d0a543470bd20a4572190e50b63e9b74e5dbba552b4fe972721518e4183beb_amd64 as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:3e5ce0a56241c9804249dfb302cde02d2ffe30ba8fcd8aef8f1bce916d2324ad_ppc64le as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:d64bb14bf73ef1bc222525bffb67a3dfab0ba3ceef4770beb8138699609d4b41_s390x as a component of Red Hat Quay 3.9
  • registry.redhat.io/quay/quay-rhel8@sha256:dd567423c854e8732542c41bfcda71948517762f8e91e31496e7dffa67b3c8c0_amd64 as a component of Red Hat Quay 3.9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (13)