RHSA-2026:6567HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.16.3

Published
April 3, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (13)

CVE-2026-27628 →CVE-2025-13465 →CVE-2025-68121 →CVE-2026-25639 →CVE-2026-26996 →CVE-2026-27904 →CVE-2026-28498 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-68158 →CVE-2025-69873 →CVE-2026-25990 →CVE-2026-26007 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68158 — Authlib: Authlib: Cross-Site Request Forgery due to improper session management in state storage CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27628 — pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-28498 — authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens

🎯 Affected products24

  • Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:618838ba45069cb93c48acc40c19186a5e471d4ea17f8f057a5187e74d196a9b_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:6f505834f4023e94f791769bb6726d24e8e94605ee525d4f657b38ec2810e06f_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/clair-rhel9@sha256:bbd4e466a0973195c134bc7bd406a824a5e205201559931d2975fd337b435e7c_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:d5ad15db6f5f6271dbff37712024fb3aee765d29a88c58b65be8a174fdfffa04_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:22039703011a8853c57bad658c5d6d4b44543a8924d24b0c6e1eeb47a4092152_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:361f6631b82a6b550dcbd1ae3748229fd72e2b9ab5dfb537f326f680ded5700f_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:ce3149ec9752b6d48be532e33be903a30746237b27e5daa3d64358533981ddee_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1d0b2c18a32a5e1195a65e2c6fe5c79f8acd1695a56e848302621a87e5ec041c_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:053e4754b5cae3086a44d302f5dc3254e4d7e312b154972774c5793d988846e8_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:cd0cec48f12c48bcaaeb5393be4a05d14d2bdad5d0c6071f3a1d4281fd43b58d_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:f5bd5ebf3c14a2320c7196c895df050b0dd605603f1a2fadff6901f3fdd44194_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:1ea5311ae56a211c4424a42d023745b962e8d322bb77097773d4621f0c0d5e91_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:2c1cb5de345c1ad4cb605d9b22ebbf1b0b0f8fbae51ebe04f63c522d4a27938e_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:9bc7b33061b26d6192081ce3fd9fcf2b7c3be9cd9b7901bbc0893d2db87017f2_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:fdcdd27be37044e0ab7b599ccc825b4ab3b3a77cb82d5436462098602a6b5a8d_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-bundle@sha256:7cb7b3d876d95c43ff147d72a46a832119050f7a337e0c0e83bd35ef82df0588_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:4ed1d4a7fe3bf6e4bb19551ae6e9349a50e5b3e7e003c8624fbfa9179d6a9dad_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:96331c01153e9fe30375a824093c827be40f5ed757341845b1becc31aba21361_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-operator-rhel9@sha256:b5a1f05b332a19479f08a5493c47c088602e06983abf894c4bf86c51d0ba392f_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:5937639bb3bc4fd76c1dfa9d1550f8ab955a5d12b44794c076d127a5ba4d68a4_ppc64le as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:701d55bb5aa5d095dc759a4e07d2c7e647c401bb13e4dd868afec2ee66f51406_amd64 as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:8298307eb70190d303ad03a1b44a183df1e0fb5aa8f146e4abd028ea82d0aaf2_s390x as a component of Red Hat Quay 3.16
  • registry.redhat.io/quay/quay-rhel9@sha256:efe1b48667d21b1bc7c7d7b9c320be3e47f5679984079f1d4b976247e34ef087_arm64 as a component of Red Hat Quay 3.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)