RHSA-2026:81110HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay

Published
October 12, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (21)

CVE-2026-59886 →CVE-2026-67214 →CVE-2026-59200 →CVE-2026-67321 →CVE-2026-15792 →CVE-2026-16221 →CVE-2026-54770 →CVE-2026-67314 →CVE-2026-67320 →CVE-2026-18255 →CVE-2026-49825 →CVE-2026-54058 →CVE-2026-59204 →CVE-2026-59205 →CVE-2026-67313 →CVE-2026-44705 →CVE-2026-49477 →CVE-2026-55379 →CVE-2026-55380 →CVE-2026-59197 →CVE-2026-59199 →

📋 Description

CVE-2026-15792 — github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request CVE-2026-16221 — fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency CVE-2026-18255 — quay: quay: Global read-only superuser can view robot account tokens CVE-2026-44705 — tmp: path Traversal via unsanitized prefix/postfix enables directory escape CVE-2026-49477 — soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings CVE-2026-49825 — lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54770 — webob: WebOb: Open redirect vulnerability leading to phishing and token theft CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-67214 — nanoid: nanoid: Denial of Service via negative size input in non-secure module functions CVE-2026-67313 — axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON CVE-2026-67314 — axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth CVE-2026-67320 — axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter CVE-2026-67321 — axios: axios: Denial of Service via object serialization bypass

🎯 Affected products32

  • Red Hat Quay 3.18
  • registry.redhat.io/quay/clair-rhel9@sha256:4f94ec8fe2b983d02251106c07aca7ee1c3644912b7670855abf65e1970ffa07_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/clair-rhel9@sha256:663f7cf1c9fedef35870a0a1a06f8ffbe3d402e486c05dbc92e8172b849bef38_arm64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/clair-rhel9@sha256:8fe84adb19b96dafef4b19878ebee97427ee217873d8afd8b97a7cf512ff2c6e_s390x as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/clair-rhel9@sha256:e6873b95ff95f55f1cd822facfc35505a15d79bceaf95616142b20abd36d9fee_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:760f3cbe2008b4ee26fbcf0a9b13a94069157d2eeb7041f6d28c1879455f688b_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:339683a4b7e9b3c2e215638249ba54e6e58b859616705f14b6de5726bab9d168_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:89afd3a536d7d73fedcd6482249338d8af8ca75111afd8d24e444c3a27ee65dd_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:b9df558b98b6197803e9678fab991d3f666a47c307a94f9484d4548fc0803866_s390x as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-bridge-rhel9-operator@sha256:e389e66c1a9e75768acbd7fa59afc751a3c719675c4de0e46d83e154dadd26f4_arm64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:10329197b4be2c5a676332a6c20e1d56d612777d15e98dfdb167d84aece00303_s390x as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:1cf6a3bb9f3725046c4a7681501e0894644f9d994411f5bf8c7716a205982299_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3e446f906165886bebda1c6df453980350889f53574ab743b3131e83df825c46_arm64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:7dd67bb22149698634bc3e07c080a5cf7ce21d8f126735a2beeb0d12ea3de23c_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:49341bfc7d5ba6bb1ddf0cf484c9821009bc773b17c6699f3f42939ca271a7af_arm64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:ab30f9349033762d48305c5a2b6aeab04bbc9344a66b6d46ac002a0e8b24db6a_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:df60b5c26f467452fdae9b7d5ff8ea841865d63623a8bb182e253ed975959776_s390x as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-builder-rhel9@sha256:f5c29114adffd2a294685ba0bdbc6e1e689ec28e0afe34dd755a8a14c3b3f5b8_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2afc2cbdc6567721d142ea894a4455c3daabe0032afb3f73af070e55b977c39c_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:133ea038522c6b3183789d2ab6df9fbe98cf97136b03700654aecf8dce47934c_arm64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:152e3141de3d3408a87cfbac6dfc01cb9518043a62c31b3dab4f819484c4a4a9_s390x as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:8ad7b6bd349fdb56b9a2f28be0aac41fd7775b8ef6bcb2803b630eb9b21dce5c_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-container-security-rhel9-operator@sha256:f50ce3a257763f2e554a02ae7d8138f32dcbb7fa449eee51cad17a3c44f6b9d7_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-operator-bundle@sha256:b241d01c6f2171ead9cd1060dfd5cd0000c426eb62e475e00565c2796de881ba_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-rhel9-operator@sha256:1f0886292058d246e5e518e5bd61bcc56d0bb0983915a347bbb3f33d047aa7c2_arm64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-rhel9-operator@sha256:27eedc1b8d0e3f49409db81027855632d97f39b9526b29ddd6696171d2736b7e_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-rhel9-operator@sha256:36360e3a23441f70b0febcf81d255c099aa6750356f7059eda6ec3cc51790ed9_amd64 as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-rhel9-operator@sha256:9b0362ac7da91f2f9d31d0c3213dbcee9a690a165dc1832a98c5de4ee61677e9_s390x as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-rhel9@sha256:060f89d43333c52fdb48c5b19d9cac20078bffa4112cdb3ba2871f913afa9bc9_ppc64le as a component of Red Hat Quay 3.18
  • registry.redhat.io/quay/quay-rhel9@sha256:2774e4fe2d8c2d8d6cf6c558a0edd86f83d20c9039128753b8cef71e9b6ed8d2_arm64 as a component of Red Hat Quay 3.18
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Avoid building container images using BuildKit frontends from untrusted sources. A BuildKit frontend is typically specified using a "# syntax" directive at the top of a Dockerfile, or with the "--frontend" option to the "buildctl build" command. Only use frontend images that come from a trusted source. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Remove users who can not be trusted with robot account credentials from GLOBAL_READONLY_SUPER_USERS. Workaround: To mitigate this vulnerability, validate and sanitize any user-controlled data before it is passed to the prefix, postfix or dir options of the file or directory creation functions, specifically rejecting or stripping input containing path traversal sequences. Workaround: Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion. Workaround: Sanitize all user-supplied integer inputs before passing them to `nanoid` or `customAlphabet` functions in the `nanoid/non-secure` module, ensuring the size parameter is strictly a non-negative integer.

🔗 References (24)