RHSA-2026:99023CriticalCVSS 9.9

Red Hat Security Advisory: Red Hat Quay - 3.15.9

Published
November 11, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (41)

CVE-2026-77409 →CVE-2026-123710 →CVE-2026-32283 →CVE-2026-102268 →CVE-2026-102997 →CVE-2026-112390 →CVE-2026-94603 →CVE-2026-97687 →CVE-2026-97689 →CVE-2026-33818 →CVE-2026-56853 →CVE-2026-56860 →CVE-2026-82417 →CVE-2026-102273 →CVE-2026-49825 →CVE-2026-77412 →CVE-2026-102272 →CVE-2026-102996 →CVE-2026-102999 →CVE-2026-103000 →CVE-2026-77403 →CVE-2026-84375 →CVE-2026-102998 →CVE-2026-15792 →CVE-2026-39822 →CVE-2026-56858 →CVE-2026-67213 →CVE-2026-77404 →CVE-2026-102994 →CVE-2026-59879 →CVE-2026-77410 →CVE-2026-79921 →CVE-2026-93749 →CVE-2026-110697 →CVE-2026-42504 →CVE-2026-77406 →CVE-2026-102267 →CVE-2026-118669 →CVE-2026-54770 →CVE-2026-56859 →CVE-2026-56862 →

📋 Description

CVE-2026-15792 — github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-49825 — lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-54770 — webob: WebOb: Open redirect vulnerability leading to phishing and token theft CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-59879 — immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations CVE-2026-67213 — nanoid: nanoid: Denial of Service via infinite loop in random ID generation CVE-2026-77403 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation CVE-2026-77404 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection CVE-2026-77406 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via signed-to-unsigned integer casting CVE-2026-77409 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking CVE-2026-77410 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation CVE-2026-77412 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length CVE-2026-79921 — github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-93749 — source-map-js: source-map-js: Denial of Service via malformed indexed source maps CVE-2026-94603 — podman: podman: The podman run command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation CVE-2026-97687 — urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override CVE-2026-97689 — urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-102994 — pypdf: pypdf: Denial of Service via crafted indirect object tokens in PDF files CVE-2026-102996 — pypdf: pypdf: Denial of Service via excessive memory consumption during font parsing CVE-2026-102997 — pypdf: pypdf: Denial of Service via crafted FlateDecode stream CVE-2026-102998 — pypdf: pypdf: Denial of Service via crafted PDF form fields CVE-2026-102999 — pypdf: pypdf: Denial of Service via crafted PDF with numerous embedded files CVE-2026-103000 — pypdf: pypdf: Denial of Service via large alphabetical page labels CVE-2026-110697 — quay: quay: SQL LIKE wildcard injection in robot listing leaks cross-tenant robot tokens CVE-2026-112390 — pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing CVE-2026-118669 — oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers CVE-2026-123710 — quay: Red Hat Quay: unauthenticated registry signing-key takeover via service key rotation

🎯 Affected products25

  • Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:4d8ed28505d205560c9115d92c6230b9fa291e7f986445ee64b5d830a9de0a62_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:6d8085ade71aeb24385f5a129073b1c157a49de45343556557cc0ce8cf1efd63_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/clair-rhel8@sha256:b30a170b7d1f9c3962fc0c0444f6a70ae03d46ea97db1c03122d098c11888aae_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:091063c5567c76a33e0dbf20ea71d541ce8d0496f5c50beb724f8b79c7c5a63e_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:0dbc3702f3d9f999d01ece9ee9bd02920775e86da6d89fd186f838c6582e88e8_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:54cf6f323abd75afba2a24f4392101d48cb3eedc057bac206bc86e6aa25a4e85_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a099c0353a39d99ad2bf1d32830b6ee80ec90df0c574f9c683677447347a1188_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:25605be0c223100ebbb963de78681dcd907c249474139232c45ff45ec9ea871a_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:25a0319a83950e44bf1791ab1087fd5e81a054d6eeaceea35b8f8d29ef2d4190_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:e0e9d8c9ee717cebde0cb4a6f011c10ab8d80706d31e2d2c9ee96830dc77fc4f_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:3c25243a4434f27624d1c8938d985f29d0b56f02361bf20d4ba290c813105d89_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:560363b0077f43eeef3e3116493f60c692fb2241b30e012b41aad4209bae911e_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:80231f8a424830d8ee3897693aee77c6377be1b44e39d29200d54a50e13c7bff_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:f666e0089d06a695dfc5a7613aef33abb19cf31d00225840848f66e78056cabd_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:4abe997c4b6812e21f3805cd71f27968cfd859fdbf6ba7211c632153e7aa8f95_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:6d0a1101094df3d5a8c9bdce52066dde8adf37b139951b294abb6a4f7d844cc1_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:ea75fd3860d99be1e933886400e26d3ccafd59e0f6465dcf960aadf2d83aa4f6_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-bundle@sha256:1216be2551147d7644374d670b1e405fff8a4fb8368c00fa75b56fa6bc3d3c0c_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:147e3367f7b8c59e586568a7fe0ab06f4618fc9838ec9591b7d8dfcc00491547_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:d5c6a26321f2d5273fccae1c4299b47debe80e01e5449c1b9293fd6394188e29_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:fe99661c9698c794e7951c529c8513c953a6c7da5d91ab491ba12117b29bd334_amd64 as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:01f4e3da522484fa4f945180d265395f8c04191a8fa2772ca58173422c7aaabb_s390x as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:383d3a2a4481473ad801698a76c243347bd58ea57486286fe26cd83525e9b80a_ppc64le as a component of Red Hat Quay 3.15
  • registry.redhat.io/quay/quay-rhel8@sha256:d9260efae0570d7683eb573b814cd7c23b693861b0aecb0ee7805743edc0ddf6_amd64 as a component of Red Hat Quay 3.15

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Avoid building container images using BuildKit frontends from untrusted sources. A BuildKit frontend is typically specified using a "# syntax" directive at the top of a Dockerfile, or with the "--frontend" option to the "buildctl build" command. Only use frontend images that come from a trusted source. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present. Workaround: To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort. Workaround: To mitigate this issue, ensure application code validates the size parameter passed to customAlphabet or customRandom, rejecting or sanitizing zero-value inputs before passing them to nanoid. Workaround: To mitigate this issue, ensure that applications using the RabbitMQ amqp091-go client only connect to trusted AMQP brokers. Restrict network access for clients to only communicate with known, secure broker instances. This reduces the risk of a malicious or compromised broker exploiting the client's vulnerability during frame size negotiation. Workaround: Avoid accepting untrusted values for TLS certificate, key, CA, or server-name paths. Restrict write access to directories and environment settings used to configure those paths, and upgrade applications using amqp091-go to version 1.13.0 or later when available. Workaround: Do not allow untrusted users to control AMQP QoS prefetch settings. Validate configured values are non-negative, and update applications using amqp091-go when a fixed version is available. Workaround: Use adequately buffered notification channels and ensure event consumers continuously drain them. Update applications using amqp091-go when a fixed version is available. Workaround: Connect only to trusted AMQP brokers, protect broker credentials and transport security, and update applications using amqp091-go when a fixed version is available. Workaround: If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests. Workaround: Update to the fixed Red Hat Quay release for your version: 3.9.28, 3.10.28, 3.12.24, 3.14.10, 3.15.9, 3.16.7, 3.17.7, or 3.18.3. Red Hat has already fixed Quay.io. There is no other complete workaround. If you cannot update immediately, restrict who can create organizations or namespaces containing an underscore, rotate robot tokens for any namespace that collides with an underscore-containing one, and monitor registry activity for pulls or pushes that don't match expected robot usage. These steps reduce exposure but do not fix the underlying flaw. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py31…

🔗 References (44)