RHSA-2026:6497HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.16.3

Published
April 2, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (13)

CVE-2026-28498 →CVE-2025-13465 →CVE-2025-61728 →CVE-2025-69873 →CVE-2026-25639 →CVE-2026-25990 →CVE-2026-27904 →CVE-2025-61726 →CVE-2025-68121 →CVE-2025-68158 →CVE-2026-26007 →CVE-2026-26996 →CVE-2026-27628 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68158 — Authlib: Authlib: Cross-Site Request Forgery due to improper session management in state storage CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27628 — pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-28498 — authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens

🎯 Affected products24

  • Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:618838ba45069cb93c48acc40c19186a5e471d4ea17f8f057a5187e74d196a9b_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:6f505834f4023e94f791769bb6726d24e8e94605ee525d4f657b38ec2810e06f_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:bbd4e466a0973195c134bc7bd406a824a5e205201559931d2975fd337b435e7c_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:1ca15d4a3ec7067bb925e83588e5ac94674e77ba29969cba9137c07bafadc025_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:1d28e4844da6b1bd1e2fbad161ca68494cac166b9fa22b30a558e0d8a3c9d12d_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4b923525f815b87f3375bd5346f8261746d2e172f2f83b4604c558c4d7ae64ee_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:7b90f185ddc5973be1bc4ffd27b785debb1d519cc6c0ea400a7fbbf22dfa2375_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1d0b2c18a32a5e1195a65e2c6fe5c79f8acd1695a56e848302621a87e5ec041c_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:342f40181bab7dcc4acdbf4d28fa314fc1dd9c9a3e9e99024e7c856f46fd8092_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:af9f4557f46bb29353be32e53f3c49d32d4641859a3ed385e69423a37b04fa03_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:b97e1ced70d68a5ff55dca3fe7962995f7f9559e7305660bdf829cc60e6cb2bd_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:a48e62759aae34528989bef0e959d1e7f8eeac108e3118bbd86e909882e1b775_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:8b059901d52536b850c65e2ed38d136b2cf831dc12af8a2eea71e584fcd49354_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:943935018ddabe868b693b6078580325ec04905fd1cf13553ef7e351427caf14_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:b5e3b47f06c81244340ca599511d221efd830ff31ed15c5c3ab5ea4bbb45388f_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-bundle@sha256:1ab0303614da22f6a9e3005358de62ba1079f90f2410481603eb33b5b2f7db70_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:401ad33f2305b2f3f54823135c9d25531d55936efb7d20ca1dac5b88efc71a28_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:7aa800901c5b9a158fe07c3a632bf95920af918f70753de3ef201d3be7684ca5_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:d8e040decc94bdb06eda60acb11ff111221d059495c706e3dc9cc8c124ec603b_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:0bc25ef16eabd14562b5c15b2f242558ace42865d416820420d669436d9d71ae_arm64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:3559638cc583d4a6e550d3572f9696dc488d8f75d6f7f77c9853c4881d98dd4a_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:39155eb5f845ade84925b763885a363b95ba927e91e2ee76d8df304620b9ac0e_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:de5cfa1742d9eed1e2d7b07693559f1cf52eca41fda6cfb83d226cf3f9bafb9e_s390x as a component of Red Hat Quay 3.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)