RHSA-2026:52968HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.12.21

Published
August 10, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (17)

CVE-2026-59886 →CVE-2026-42504 →CVE-2026-54058 →CVE-2026-54060 →CVE-2026-55379 →CVE-2026-59197 →CVE-2026-59200 →CVE-2026-59885 →CVE-2026-13149 →CVE-2026-55380 →CVE-2026-57231 →CVE-2026-59199 →CVE-2026-59204 →CVE-2026-59205 →CVE-2026-59869 →CVE-2026-15927 →CVE-2026-39822 →

📋 Description

CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-15927 — quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-57231 — podman: Podman: Information disclosure via malicious container image environment variables CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59885 — pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

🎯 Affected products29

  • Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:3394a50f7806ef5eed922cab14f864627e6413480f01e9974672eb29f95bad5a_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:4c6e65b4777714412744e32d2ad21ee01b80b924426588191cbbe9eaf4800175_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:557e7101259e79eab5cd1a4a610a5ab8880e12f98d28acccdc31b0be9b0ce1b9_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/clair-rhel8@sha256:a70d13b406311b04cf1ce9f4b1181d197910e910480742a825b42dbd2c83e0d2_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:7622cccef3f39c08be99c6b8e28fabe0fc5e3abe8760a13c786d85de2262dbf3_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:45a5655f6f33994432f51159115898ae55400a5406ab9a858c3e4b6a5613c772_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:49b16d66bbb42c79b5dc976a3d94c7948ac498c9d29b7e6ddc87e99a13760e59_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:72910eeeadea17d1eb4f01a8283c9cbd5a2154697b7e3272247795f06a02ee72_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8b1b2b7399840440da8e97e9f9faf86eeb700bbc96fd617b0703556d86eef777_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:a738649ce4341ca42eef7cbcb8505af4383f34b35cf303bbce0280918aa47697_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:0e6c92bf4b91c52500ddf299e5714b2ba1e73ad9410656691247addbf3be14f2_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:3a326100aac414e5f8a763ffb90078847670983630fa2ebff143ec1e9e156795_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:d132e3fc2a83ad60d8d741a754411d34694a05d4f9c59e5702e0e2577b4fb411_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:f645ea22c97a0ff14b4e03a895c42af63efa3602d22c56b553502008907e78ea_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:bd0f7fcd14fdf12fecfdb8886e6af289a5b90e7eb16df64d47e24ee631b06b4e_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:43b159edb0c7f87ed1b5a66dc29ecb2df49e48ea5a2b44c723d55e34252ae693_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:98f38a284e1063c5faf226f8419a0259468b417117e923c602ef824c5acde59f_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f6750e66e32e304a428a246ce3f93ccce6e216445c9cb15407c7161b67c0bc2_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:dc65635f203b36787518b39b7fd8317434fe24cf5d046fb3e2c012543e3b14bf_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-bundle@sha256:ae2f8a2572f05ee980f90290779768eb0d91d265b5d66bfbd09aea0973e075c8_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:0729b617a3b83bf3dd2eb7a6e0de1532f096ac39e6c4c82f027fb7267271f872_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:361d838ebf83dea3d3075155dec1a645809126fef6ddf48ecb61296b3f8ab05e_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:36897c430fc5f5dfd8ef5db3aedcf5122955b492c3adb2849c375266a2efa65c_amd64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:af8a9422939adc196fdfd5d66568778567609cc720e15b53f1f4bdd0ab18b6cd_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-rhel8@sha256:070e847ec43b0701f20ca5c4caf0e3f910a3693ffe1de52025bd718d01e4f3a2_s390x as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-rhel8@sha256:0dd63eccda8c69552dfc04e0607fe1e2f6b1ea872619a1dfb9bc8584b6b1f4a9_ppc64le as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-rhel8@sha256:15a7bbee76c4c5501b70e2cec051440468792c6386e690be27630afc0f3e27ef_arm64 as a component of Red Hat Quay 3.12
  • registry.redhat.io/quay/quay-rhel8@sha256:fd1be0c0678534969d64f2449bfe30b7f5560136db4f6a8bf38adad50dc9bfa0_amd64 as a component of Red Hat Quay 3.12

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Restrict network egress from Quay mirror worker pods/containers using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Limit repository creation and admin privileges to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to the mirror API endpoints through a reverse proxy. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

🔗 References (20)