RHSA-2026:53520HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.10.25

Published
August 11, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (17)

CVE-2026-59199 →CVE-2026-59886 →CVE-2026-39822 →CVE-2026-54060 →CVE-2026-55379 →CVE-2026-59200 →CVE-2026-15927 →CVE-2026-42504 →CVE-2026-59204 →CVE-2026-59205 →CVE-2026-59869 →CVE-2026-59885 →CVE-2026-13149 →CVE-2026-54058 →CVE-2026-55380 →CVE-2026-57231 →CVE-2026-59197 →

📋 Description

CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-15927 — quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-57231 — podman: Podman: Information disclosure via malicious container image environment variables CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59885 — pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

🎯 Affected products23

  • Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:18b2bce956cfc6f6fbcd58be41b3a4ed9429336bd5d7c4b100f267b90a207c8e_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:a34629c7545fcb9fcc3ab9cb641eb5c8ebb6296a1d3fdaa73db75b6f236d9a18_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:f58bdb68a2cca947dcd330bbfbc9d2ef5e9d0015eded00f74856345b6a962962_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5b566b025d232e63ee8bbc6768c5c27aa0dc4760362aca1e82b588d61ff06f0f_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2f42892b36358ff044d9f0542f207837ae3c1f1d021e9906489ffe04aaeda493_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:66ece0a989503dfa46045c70c8f8937775b3dc7324fbcbfcbc68c940b882a708_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c4c0ae660f538767064ca9a2a98003e60b6960e5290d5d70d95e9913958b890_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f0bff8e6bbe9eb4cb03dc3ccc09325d64988a81dd31d1b468462f3feb0a41e02_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:42fc54dce8bc2ccfaa992560a4893248b449f8bd0fe58f2ed71a407f16518c26_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:467a021912c1193ef407d4a8183f4c686e15158e581cf21350fa12cd94d32296_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:8cc3f4757c27ccab1bcfeddf93a8f3cc820563aba0a174545e649843fe4fce17_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:f892742e326b7434c6430f1eef16412143b7798954eedd49b946f0f78323dccc_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5ce39e31a69193bac6b30b61f0c5731fdc57740071c642e53f57be2eae9fa979_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:ca62a0f23d2b2de9bc5fcaf06cfa0546a0320ddd8ec64e1a7cd583904227d973_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f1728933739482fa3838501620a8386f29c85fe01e35e8ef6aa952d454143a1b_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-bundle@sha256:42395aa2236cdfbaa5396e6d81559506dfe122159c67bc37aba15ab9cb584ee0_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:00ef0609a8b831bead9c9dbb061e3de37203f13618239620b8ddef5460e29012_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:377c751454d9edf35778cbf738b4fb44aed9ef046fe4259efec77535ed3c29f5_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:f6cb5880c7fd302051aa69a14da04efded389890443aaabf7f6e0af8761330e9_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:2909ad1c51b87aede3203ae8a343fd590e90f27d7ec5714929eb69d5dc742d52_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:37553aa3ccffb385972f98b0a01c096a8ebdd17931953d724dd5e9736820880e_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:967c0ce73afdafe4fe21dc196bc938864b437f6a3c3af99b8247abfe4535b395_amd64 as a component of Red Hat Quay 3.1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Restrict network egress from Quay mirror worker pods/containers using network policies or firewall rules to block access to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Limit repository creation and admin privileges to trusted users via Quay's RBAC configuration. If repository-level mirroring is not required, disable the feature or restrict access to the mirror API endpoints through a reverse proxy. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

🔗 References (20)