Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-44492 (GCVE-0-2026-44492)
Vulnerability from cvelistv5 – Published: 2026-06-11 15:29 – Updated: 2026-07-23 12:08
VLAI
EPSS
VEX
Title
Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Summary
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
41 references
Impacted products
66 products
| Vendor | Product | Version | |
|---|---|---|---|
| axios | axios |
Affected:
>= 1.0.0, < 1.16.0
Affected: < 0.32.0 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:2.5.20260715-1.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:2.5.20260715-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Data Grid 8.6.2 |
cpe:/a:redhat:jboss_data_grid:8 |
|
| Red Hat | multicluster engine for Kubernetes 2.6 |
Unaffected:
1783351002 , < *
(rpm)
cpe:/a:redhat:multicluster_engine:2.6::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.8 |
Unaffected:
1782157085 , < *
(rpm)
cpe:/a:redhat:multicluster_engine:2.8::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.9 |
Unaffected:
1783348181 , < *
(rpm)
cpe:/a:redhat:multicluster_engine:2.9::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 |
Unaffected:
1783350952 , < *
(rpm)
cpe:/a:redhat:acm:2.11::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 |
Unaffected:
1782157514 , < *
(rpm)
cpe:/a:redhat:acm:2.13::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 |
Unaffected:
1783451729 , < *
(rpm)
cpe:/a:redhat:acm:2.14::el9 |
|
| Red Hat | Red Hat Advanced Cluster Security 4.9 |
Unaffected:
1779371594 , < *
(rpm)
cpe:/a:redhat:advanced_cluster_security:4.9::el8 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 |
Unaffected:
1779293013 , < *
(rpm)
cpe:/a:redhat:advanced_cluster_security:4.10::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.7 |
Unaffected:
1783919486 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.7::el9 |
|
| Red Hat | Red Hat Container Native Virtualization 4.13 |
Unaffected:
1782426816 , < *
(rpm)
cpe:/a:redhat:container_native_virtualization:4.13::el9 |
|
| Red Hat | Red Hat Container Native Virtualization 4.14 |
Unaffected:
1782356760 , < *
(rpm)
cpe:/a:redhat:container_native_virtualization:4.14::el9 |
|
| Red Hat | Red Hat Developer Hub 1.10 |
Unaffected:
1783448184 , < *
(rpm)
cpe:/a:redhat:rhdh:1.10::el9 |
|
| Red Hat | Red Hat Developer Hub 1.9 |
Unaffected:
1781187342 , < *
(rpm)
Unaffected: 1782761244 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9 |
|
| Red Hat | Red Hat Discovery 2 |
Unaffected:
1782166952 , < *
(rpm)
cpe:/a:redhat:discovery:2::el9 |
|
| Red Hat | Red Hat Migration Toolkit 1.8 |
Unaffected:
1783690532 , < *
(rpm)
cpe:/a:redhat:rhmt:1.8::el8 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.14 |
Unaffected:
1782911957 , < *
(rpm)
cpe:/a:redhat:openshift:4.14::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.15 |
Unaffected:
1782127091 , < *
(rpm)
cpe:/a:redhat:openshift:4.15::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.16 |
Unaffected:
1782244020 , < *
(rpm)
cpe:/a:redhat:openshift:4.16::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
1782880472 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.20 |
Unaffected:
1781695012 , < *
(rpm)
cpe:/a:redhat:openshift:4.20::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.21 |
Unaffected:
1781731914 , < *
(rpm)
cpe:/a:redhat:openshift:4.21::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 |
Unaffected:
1782498475 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.29::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 |
Unaffected:
1782498792 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.29::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 2.6 |
Unaffected:
1781937133 , < *
(rpm)
cpe:/a:redhat:service_mesh:2.6::el8 |
|
| Red Hat | Red Hat OpenShift Service Mesh 2.6 |
Unaffected:
1782287580 , < *
(rpm)
cpe:/a:redhat:service_mesh:2.6::el8 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
Unaffected:
1782201894 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.0::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
Unaffected:
1782201833 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.0::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
Unaffected:
1782201696 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.1::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
Unaffected:
1782201537 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.1::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
Unaffected:
1782201851 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.2::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
Unaffected:
1782201812 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.2::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
Unaffected:
1782231869 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.3::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
Unaffected:
1782201466 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.3::el9 |
|
| Red Hat | Red Hat Quay 3.1 |
Unaffected:
1783750447 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1783751865 , < *
(rpm)
Unaffected: 1784353904 , < * (rpm) cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1784351966 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1783955846 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1784125838 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
Unaffected:
1784105894 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.3::el9 |
|
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4 |
|
| Red Hat | Gatekeeper 3 |
cpe:/a:redhat:gatekeeper:3 |
|
| Red Hat | Migration Toolkit for Applications 8 |
cpe:/a:redhat:migration_toolkit_applications:8 |
|
| Red Hat | Network Observability Operator |
cpe:/a:redhat:network_observ_optr:1 |
|
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1 |
|
| Red Hat | OpenShift Service Mesh 3 |
cpe:/a:redhat:service_mesh:3 |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 |
cpe:/a:redhat:camel_spring_boot:4 |
|
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 |
cpe:/a:redhat:apache_camel_hawtio:4 |
|
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3 |
|
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview |
cpe:/a:redhat:podman_desktop:0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3 |
|
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
|
| Red Hat | Red Hat Trusted Profile Analyzer |
cpe:/a:redhat:trusted_profile_analyzer:2 |
|
| Red Hat | Self-service automation portal 2 |
cpe:/a:redhat:ansible_portal:2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44492",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-13T02:10:20.471026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-13T02:11:59.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260715-1.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-gateway",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.20260715-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "axios",
"product": "Red Hat Data Grid 8.6.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/console-mce-rhel9",
"product": "multicluster engine for Kubernetes 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783351002",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/console-mce-rhel9",
"product": "multicluster engine for Kubernetes 2.8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782157085",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/console-mce-rhel9",
"product": "multicluster engine for Kubernetes 2.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783348181",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:acm:2.11::el9"
],
"defaultStatus": "affected",
"packageName": "rhacm2/console-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783350952",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhacm2/console-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782157514",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"defaultStatus": "affected",
"packageName": "rhacm2/console-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783451729",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-main-rhel8",
"product": "Red Hat Advanced Cluster Security 4.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779371594",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-main-rhel8",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779293013",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.7::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-27/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783919486",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "container-native-virtualization/kubevirt-console-plugin-rhel9",
"product": "Red Hat Container Native Virtualization 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782426816",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "container-native-virtualization/kubevirt-console-plugin-rhel9",
"product": "Red Hat Container Native Virtualization 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782356760",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhdh:1.10::el9"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-hub-rhel9",
"product": "Red Hat Developer Hub 1.10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783448184",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-hub-rhel9",
"product": "Red Hat Developer Hub 1.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781187342",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "1782761244",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "affected",
"packageName": "discovery/discovery-ui-rhel9",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782166952",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhmt:1.8::el8"
],
"defaultStatus": "affected",
"packageName": "rhmtc/openshift-migration-ui-rhel8",
"product": "Red Hat Migration Toolkit 1.8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783690532",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-console",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782911957",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-console",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782127091",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-console-rhel9",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782244020",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-monitoring-plugin-rhel9",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782880472",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-monitoring-plugin-rhel9",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781695012",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-monitoring-plugin-rhel9",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781731914",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/code-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782498475",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/dashboard-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782498792",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:2.6::el8"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-ossmc-rhel8",
"product": "Red Hat OpenShift Service Mesh 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781937133",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:2.6::el8"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-rhel8",
"product": "Red Hat OpenShift Service Mesh 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782287580",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201894",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201833",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201696",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201537",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201851",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201812",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782231869",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/kiali-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782201466",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783750447",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783751865",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "1784353904",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784351966",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783955846",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784125838",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/rhtas-console-ui-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784105894",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "axios",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "cryostat-openshift-console-plugin-npm",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:gatekeeper:3"
],
"defaultStatus": "unaffected",
"packageName": "gatekeeper/gatekeeper-rhel9",
"product": "Gatekeeper 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "unaffected",
"packageName": "mta/mta-ui-rhel8",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "affected",
"packageName": "mta/mta-ui-rhel9",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-pf4-rhel9",
"product": "Network Observability Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-pf5-rhel9",
"product": "Network Observability Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1"
],
"defaultStatus": "affected",
"packageName": "network-observability/network-observability-console-plugin-rhel9",
"product": "Network Observability Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"packageName": "openshift-pipelines/pipelines-hub-ui-rhel8",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"packageName": "openshift-pipelines/pipelines-hub-ui-rhel9",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"packageName": "openshift-service-mesh/kiali-operator-bundle",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"packageName": "openshift-service-mesh/kiali-rhel9-operator",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"packageName": "3scale-amp21/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"packageName": "3scale-amp22/system",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"packageName": "3scale-amp2/system-rhel7",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"packageName": "3scale-amp2/system-rhel8",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"packageName": "3scale-amp2/system-rhel9",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "axios",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/automation-dashboard-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "automation-hub",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "automation-platform-ui",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-galaxy-ng",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.12-galaxy-ng",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3x-galaxy-ng",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python-galaxy-ng",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_spring_boot:4"
],
"defaultStatus": "unaffected",
"packageName": "axios",
"product": "Red Hat build of Apache Camel for Spring Boot 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
],
"defaultStatus": "affected",
"packageName": "axios",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "apicurio/apicurio-registry-ui-rhel8",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "apicurio/apicurio-registry-ui-rhel9",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:podman_desktop:0"
],
"defaultStatus": "affected",
"packageName": "rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10",
"product": "Red Hat Build of Podman Desktop - Tech Preview",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "grafana-pcp",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-gaudi-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-rocm-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"packageName": "rhelai3/disk-image-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "axios",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-dashboard-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-dashboard-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-mlflow-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-automl-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-autorag-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-eval-hub-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-mod-arch-maas-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-mlflow-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-agent-installer-ui-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"packageName": "container-native-virtualization/kubevirt-console-plugin",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-advisor-frontend-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-host-inventory-frontend-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-vulnerability-frontend-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_profile_analyzer:2"
],
"defaultStatus": "affected",
"packageName": "rhtpa/rhtpa-trustification-service-rhel9",
"product": "Red Hat Trusted Profile Analyzer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_portal:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/automation-portal",
"product": "Self-service automation portal 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_portal:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
"product": "Self-service automation portal 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-11T15:29:13.890Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-289",
"description": "Authentication Bypass by Alternate Name",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T12:08:11.327Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"name": "RHBZ#2487938",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42078"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41064"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30651"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36882"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20938"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20889"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42142"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36108"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33005"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41951"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36754"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33574"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26234"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41928"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36611"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28964"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29082"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34766"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27063"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27044"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36820"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33155"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33160"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33163"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33173"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33183"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42085"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41055"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30650"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36883"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42078: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:41064: Red Hat Advanced Cluster Management for Kubernetes 2.11"
},
{
"lang": "en",
"value": "RHSA-2026:30651: Red Hat Advanced Cluster Management for Kubernetes 2.13"
},
{
"lang": "en",
"value": "RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14"
},
{
"lang": "en",
"value": "RHSA-2026:20938: Red Hat Advanced Cluster Security 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:20889: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:42142: Red Hat Ansible Automation Platform 2.7"
},
{
"lang": "en",
"value": "RHSA-2026:36108: Red Hat Container Native Virtualization 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:33005: Red Hat Container Native Virtualization 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
},
{
"lang": "en",
"value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
},
{
"lang": "en",
"value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
},
{
"lang": "en",
"value": "RHSA-2026:26234: Red Hat Developer Hub 1.9"
},
{
"lang": "en",
"value": "RHSA-2026:29197: Red Hat Discovery 2"
},
{
"lang": "en",
"value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
},
{
"lang": "en",
"value": "RHSA-2026:36611: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:29082: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:34766: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:27063: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:27044: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
},
{
"lang": "en",
"value": "RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:33160: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:42146: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:43052: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:42796: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:41066: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:41031: Red Hat Quay 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:40262: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:42085: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:41055: multicluster engine for Kubernetes 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:30650: multicluster engine for Kubernetes 2.8"
},
{
"lang": "en",
"value": "RHSA-2026:36883: multicluster engine for Kubernetes 2.9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-11T17:00:56.761Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-11T15:29:13.890Z",
"value": "Made public."
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "axios",
"vendor": "axios",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.16.0"
},
{
"status": "affected",
"version": "\u003c 0.32.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T15:29:13.890Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"source": {
"advisory": "GHSA-pjwm-pj3p-43mv",
"discovery": "UNKNOWN"
},
"title": "Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44492",
"datePublished": "2026-06-11T15:29:13.890Z",
"dateReserved": "2026-05-06T17:18:51.783Z",
"dateUpdated": "2026-07-23T12:08:11.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-44492",
"date": "2026-07-25",
"epss": "0.0087",
"percentile": "0.55091"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-44492\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-11T17:16:33.167\",\"lastModified\":\"2026-07-23T12:18:10.303\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"axios\",\"product\":\"axios\",\"versions\":[{\"version\":\"\u003e= 1.0.0, \u003c 1.16.0\",\"status\":\"affected\"},{\"version\":\"\u003c 0.32.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"0:2.5.20260715-1.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"],\"versions\":[{\"version\":\"0:2.5.20260715-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8.6.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"axios\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/console-mce-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.6::el9\"],\"versions\":[{\"version\":\"1783351002\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/console-mce-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.8::el9\"],\"versions\":[{\"version\":\"1782157085\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/console-mce-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.9::el9\"],\"versions\":[{\"version\":\"1783348181\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.11\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhacm2/console-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2.11::el9\"],\"versions\":[{\"version\":\"1783350952\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhacm2/console-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2.13::el9\"],\"versions\":[{\"version\":\"1782157514\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhacm2/console-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2.14::el9\"],\"versions\":[{\"version\":\"1783451729\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"advanced-cluster-security/rhacs-main-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"],\"versions\":[{\"version\":\"1779371594\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"advanced-cluster-security/rhacs-main-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"],\"versions\":[{\"version\":\"1779293013\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-27/gateway-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.7::el9\"],\"versions\":[{\"version\":\"1783919486\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/kubevirt-console-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.13::el9\"],\"versions\":[{\"version\":\"1782426816\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/kubevirt-console-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.14::el9\"],\"versions\":[{\"version\":\"1782356760\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhdh/rhdh-hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.10::el9\"],\"versions\":[{\"version\":\"1783448184\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhdh/rhdh-hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.9::el9\"],\"versions\":[{\"version\":\"1781187342\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"1782761244\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"discovery/discovery-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"],\"versions\":[{\"version\":\"1782166952\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Migration Toolkit 1.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhmtc/openshift-migration-ui-rhel8\",\"cpes\":[\"cpe:/a:redhat:rhmt:1.8::el8\"],\"versions\":[{\"version\":\"1783690532\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-console\",\"cpes\":[\"cpe:/a:redhat:openshift:4.14::el9\"],\"versions\":[{\"version\":\"1782911957\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-console\",\"cpes\":[\"cpe:/a:redhat:openshift:4.15::el9\"],\"versions\":[{\"version\":\"1782127091\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.16::el9\"],\"versions\":[{\"version\":\"1782244020\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-monitoring-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"],\"versions\":[{\"version\":\"1782880472\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-monitoring-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.20::el9\"],\"versions\":[{\"version\":\"1781695012\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-monitoring-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.21::el9\"],\"versions\":[{\"version\":\"1781731914\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.29\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/code-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"],\"versions\":[{\"version\":\"1782498475\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.29\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"],\"versions\":[{\"version\":\"1782498792\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-ossmc-rhel8\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2.6::el8\"],\"versions\":[{\"version\":\"1781937133\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-rhel8\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2.6::el8\"],\"versions\":[{\"version\":\"1782287580\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-ossmc-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"],\"versions\":[{\"version\":\"1782201894\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"],\"versions\":[{\"version\":\"1782201833\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-ossmc-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"],\"versions\":[{\"version\":\"1782201696\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"],\"versions\":[{\"version\":\"1782201537\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-ossmc-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"],\"versions\":[{\"version\":\"1782201851\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"],\"versions\":[{\"version\":\"1782201812\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-ossmc-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"],\"versions\":[{\"version\":\"1782231869\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"],\"versions\":[{\"version\":\"1782201466\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"],\"versions\":[{\"version\":\"1783750447\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"],\"versions\":[{\"version\":\"1783751865\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"1784353904\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"],\"versions\":[{\"version\":\"1784351966\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1783955846\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"],\"versions\":[{\"version\":\"1784125838\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/rhtas-console-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"],\"versions\":[{\"version\":\"1784105894\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"axios\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"cryostat-openshift-console-plugin-npm\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Gatekeeper 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gatekeeper/gatekeeper-rhel9\",\"cpes\":[\"cpe:/a:redhat:gatekeeper:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mta/mta-ui-rhel8\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mta/mta-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"network-observability/network-observability-console-plugin-pf4-rhel9\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"network-observability/network-observability-console-plugin-pf5-rhel9\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"network-observability/network-observability-console-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-pipelines/pipelines-hub-ui-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-pipelines/pipelines-hub-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-service-mesh/kiali-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp21/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp22/system\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/system-rhel7\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/system-rhel8\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/system-rhel9\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"axios\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/automation-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-hub\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-platform-ui\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-galaxy-ng\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-galaxy-ng\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3x-galaxy-ng\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-galaxy-ng\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel for Spring Boot 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"axios\",\"cpes\":[\"cpe:/a:redhat:camel_spring_boot:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel - HawtIO 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"axios\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"apicurio/apicurio-registry-ui-rhel8\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"apicurio/apicurio-registry-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Podman Desktop - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10\",\"cpes\":[\"cpe:/a:redhat:podman_desktop:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana-pcp\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/disk-image-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"axios\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-dashboard-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-automl-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-autorag-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-eval-hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-gen-ai-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-maas-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-model-registry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-agent-installer-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/kubevirt-console-plugin\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-advisor-frontend-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-host-inventory-frontend-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-vulnerability-frontend-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Profile Analyzer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtpa/rhtpa-trustification-service-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_profile_analyzer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Self-service automation portal 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/automation-portal\",\"cpes\":[\"cpe:/a:redhat:ansible_portal:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Self-service automation portal 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/bootc-automation-portal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_portal:2\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-13T02:10:20.471026Z\",\"id\":\"CVE-2026-44492\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-289\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"0.32.0\",\"matchCriteriaId\":\"CC9D9AB4-047A-4638-AF10-7D08587A01C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"1.0.0\",\"versionEndExcluding\":\"1.16.0\",\"matchCriteriaId\":\"BE82EB7B-A379-416F-9737-4191F720B8C6\"}]}]}],\"references\":[{\"url\":\"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20889\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20938\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26234\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27044\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27063\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28964\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29082\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29197\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30650\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30651\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33005\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33155\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33160\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33163\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33173\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33183\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33574\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34766\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36108\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36611\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36754\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36820\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36882\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36883\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40262\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41031\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41055\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41064\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41066\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41928\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41951\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42078\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42085\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42142\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42146\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43052\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-44492\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2487938\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-25T18:18:18+00:00",
"cve": "CVE-2026-44492",
"id": "CVE-2026-44492",
"initial_release_date": "2026-06-11T15:29:13.890000+00:00",
"product_status:fixed": "141",
"product_status:known_affected": "28",
"product_status:known_not_affected": "4169",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.20260715-1.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-gateway\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.20260715-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-gateway\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8.6.2\", \"packageName\": \"axios\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783351002\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/console-mce-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782157085\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/console-mce-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783348181\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-engine/console-mce-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.11\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783350952\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhacm2/console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782157514\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhacm2/console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783451729\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhacm2/console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779371594\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779293013\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783919486\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-27/gateway-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782426816\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/kubevirt-console-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782356760\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/kubevirt-console-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783448184\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhdh/rhdh-hub-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781187342\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"1782761244\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhdh/rhdh-hub-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782166952\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1.8::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Migration Toolkit 1.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783690532\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhmtc/openshift-migration-ui-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782911957\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/ose-console\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782127091\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/ose-console\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782244020\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/ose-console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782880472\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/ose-monitoring-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781695012\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/ose-monitoring-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781731914\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift4/ose-monitoring-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.29\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782498475\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/code-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.29\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782498792\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/dashboard-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781937133\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-ossmc-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782287580\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201894\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-ossmc-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201833\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201696\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-ossmc-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201537\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201851\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-ossmc-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201812\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782231869\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-ossmc-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782201466\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/kiali-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783750447\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783751865\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784351966\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783955846\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784125838\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784105894\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/rhtas-console-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"axios\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"cryostat-openshift-console-plugin-npm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:gatekeeper:3\"], \"vendor\": \"Red Hat\", \"product\": \"Gatekeeper 3\", \"packageName\": \"gatekeeper/gatekeeper-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"packageName\": \"mta/mta-ui-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"packageName\": \"mta/mta-ui-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability Operator\", \"packageName\": \"network-observability/network-observability-console-plugin-pf4-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability Operator\", \"packageName\": \"network-observability/network-observability-console-plugin-pf5-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability Operator\", \"packageName\": \"network-observability/network-observability-console-plugin-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"packageName\": \"openshift-pipelines/pipelines-hub-ui-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"packageName\": \"openshift-pipelines/pipelines-hub-ui-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"packageName\": \"openshift-service-mesh/kiali-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"packageName\": \"openshift-service-mesh/kiali-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp21/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp22/system\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/system-rhel7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/system-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/system-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"axios\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform/automation-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-hub\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-platform-ui\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.11-galaxy-ng\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.12-galaxy-ng\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3x-galaxy-ng\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python-galaxy-ng\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_spring_boot:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel for Spring Boot 4\", \"packageName\": \"axios\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel - HawtIO 4\", \"packageName\": \"axios\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"apicurio/apicurio-registry-ui-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"apicurio/apicurio-registry-ui-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:podman_desktop:0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Podman Desktop - Tech Preview\", \"packageName\": \"rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"grafana-pcp\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-gaudi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/disk-image-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"axios\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-dashboard-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlflow-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-automl-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-autorag-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-eval-hub-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-gen-ai-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-maas-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-mlflow-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-model-registry-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-agent-installer-ui-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/kubevirt-console-plugin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-advisor-frontend-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-host-inventory-frontend-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-vulnerability-frontend-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_profile_analyzer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Profile Analyzer\", \"packageName\": \"rhtpa/rhtpa-trustification-service-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_portal:2\"], \"vendor\": \"Red Hat\", \"product\": \"Self-service automation portal 2\", \"packageName\": \"ansible-automation-platform/automation-portal\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_portal:2\"], \"vendor\": \"Red Hat\", \"product\": \"Self-service automation portal 2\", \"packageName\": \"ansible-automation-platform/bootc-automation-portal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-11T17:00:56.761Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-11T15:29:13.890Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:42078: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41064: Red Hat Advanced Cluster Management for Kubernetes 2.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30651: Red Hat Advanced Cluster Management for Kubernetes 2.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20938: Red Hat Advanced Cluster Security 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20889: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42142: Red Hat Ansible Automation Platform 2.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36108: Red Hat Container Native Virtualization 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33005: Red Hat Container Native Virtualization 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41951: Red Hat Data Grid 8.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36754: Red Hat Developer Hub 1.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33574: Red Hat Developer Hub 1.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26234: Red Hat Developer Hub 1.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29197: Red Hat Discovery 2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41928: Red Hat Migration Toolkit 1.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36611: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29082: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34766: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27063: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27044: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33160: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42146: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42796: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41066: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41031: Red Hat Quay 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40262: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42085: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41055: multicluster engine for Kubernetes 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30650: multicluster engine for Kubernetes 2.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36883: multicluster engine for Kubernetes 2.9\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-11T15:29:13.890Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-44492\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2487938\", \"name\": \"RHBZ#2487938\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42078\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41064\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30651\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36882\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20938\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20889\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42142\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36108\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33005\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41951\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36754\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33574\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26234\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29197\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41928\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36611\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28964\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29082\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34766\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27063\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27044\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36820\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33155\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33160\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33163\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33173\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33183\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42146\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42796\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41066\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41031\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40262\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42085\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41055\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30650\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36883\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-289\", \"description\": \"Authentication Bypass by Alternate Name\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-22T12:08:36.390Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44492\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-13T02:10:20.471026Z\"}}}], \"references\": [{\"url\": \"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-13T02:11:25.949Z\"}}], \"cna\": {\"title\": \"Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)\", \"source\": {\"advisory\": \"GHSA-pjwm-pj3p-43mv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"axios\", \"product\": \"axios\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.0.0, \u003c 1.16.0\"}, {\"status\": \"affected\", \"version\": \"\u003c 0.32.0\"}]}], \"references\": [{\"url\": \"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv\", \"name\": \"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-11T15:29:13.890Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-44492\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-22T12:08:36.390Z\", \"dateReserved\": \"2026-05-06T17:18:51.783Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-11T15:29:13.890Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:42796
Vulnerability from csaf_redhat - Published: 2026-07-21 13:53 - Updated: 2026-07-25 19:05Summary
Red Hat Security Advisory: Red Hat Quay 3.15.6
Severity
Important
Notes
Topic: Red Hat Quay 3.15.6 is now available with bug fixes.
Details: Quay 3.15.6
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client's event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
5.2 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.
8.6 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.
7.0 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
References
217 references
Acknowledgments
Antony Di Scala
Michael Whale
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.15.6 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.15.6",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:42796",
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10143",
"url": "https://access.redhat.com/security/cve/CVE-2026-10143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12143",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39831",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44486",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44487",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44488",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44492",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44494",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44495",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44496",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9277",
"url": "https://access.redhat.com/security/cve/CVE-2026-9277"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42796.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.15.6",
"tracking": {
"current_release_date": "2026-07-25T19:05:52+00:00",
"generator": {
"date": "2026-07-25T19:05:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:42796",
"initial_release_date": "2026-07-21T13:53:09+00:00",
"revision_history": [
{
"date": "2026-07-21T13:53:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-21T13:53:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-25T19:05:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.15",
"product": {
"name": "Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.15::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3Ab42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784352323"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784351626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1784352589"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ae328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784351655"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784352052"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784351680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Abdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784351652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3Aab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1784356254"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784351641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784351966"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Af6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784351626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ace5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784351655"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784351680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784351652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aefcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784351641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784351966"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784351626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784351655"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784351680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784351652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784351641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784351966"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-9277",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-05-22T14:01:14.427751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480741"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9277"
},
{
"category": "external",
"summary": "RHBZ#2480741",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote",
"url": "https://github.com/ljharb/shell-quote"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote/commit/1518179",
"url": "https://github.com/ljharb/shell-quote/commit/1518179"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p",
"url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/shell-quote",
"url": "https://www.npmjs.com/package/shell-quote"
}
],
"release_date": "2026-05-22T13:22:38.873000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators"
},
{
"cve": "CVE-2026-10143",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-10T21:02:14.712750+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487722"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client\u0027s event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10143"
},
{
"category": "external",
"summary": "RHBZ#2487722",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487722"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143"
},
{
"category": "external",
"summary": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b",
"url": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b"
},
{
"category": "external",
"summary": "https://github.com/dpkp/kafka-python/pull/3019",
"url": "https://github.com/dpkp/kafka-python/pull/3019"
},
{
"category": "external",
"summary": "https://github.com/dpkp/kafka-python/pull/3026",
"url": "https://github.com/dpkp/kafka-python/pull/3026"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py",
"url": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py"
}
],
"release_date": "2026-06-10T20:22:39.262000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count"
},
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39831",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-22T04:01:12.861178+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "RHBZ#2480675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://go.dev/cl/781662",
"url": "https://go.dev/cl/781662"
},
{
"category": "external",
"summary": "https://go.dev/issue/79566",
"url": "https://go.dev/issue/79566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5019",
"url": "https://pkg.go.dev/vuln/GO-2026-5019"
}
],
"release_date": "2026-05-22T02:31:27.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:30.944384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "RHBZ#2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"
}
],
"release_date": "2026-06-11T15:39:07.714000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:34.091476+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487948"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "RHBZ#2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v",
"url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"
}
],
"release_date": "2026-06-11T15:38:25.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via redirect flows"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T17:01:36.836488+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Denial of Service due to unenforced request and response size limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "RHBZ#2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"
}
],
"release_date": "2026-06-11T15:37:38.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Denial of Service due to unenforced request and response size limits"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-06-11T17:00:56.761751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487938"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "RHBZ#2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"release_date": "2026-06-11T15:29:13.890000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:01:12.945664+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "RHBZ#2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"
}
],
"release_date": "2026-06-11T15:32:03.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution"
},
{
"cve": "CVE-2026-44495",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:00:53.999811+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Axios, a promise-based HTTP client, can lead to information disclosure, including credential theft and response hijacking, or denial of service. Exploitation requires a separate prototype pollution vulnerability in the same JavaScript process, allowing an attacker to control `Object.prototype.transformResponse`. Red Hat products using affected Axios versions are at risk if another component introduces such pollution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "RHBZ#2487937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"
}
],
"release_date": "2026-06-11T15:33:12.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure due to prototype pollution vulnerability"
},
{
"cve": "CVE-2026-44496",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-06-11T17:01:15.856386+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487943"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "RHBZ#2487943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"
}
],
"release_date": "2026-06-11T15:34:28.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name"
},
{
"cve": "CVE-2026-44990",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-12T21:02:24.911971+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "RHBZ#2488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
}
],
"release_date": "2026-06-12T20:39:47.065000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/crypto/ssh release via updated golang or package rebuilds. Ensure SSH servers use supported public-key callback configurations with source-address validation as intended.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
}
]
}
RHSA-2026:43052
Vulnerability from csaf_redhat - Published: 2026-07-21 22:47 - Updated: 2026-07-25 19:05Summary
Red Hat Security Advisory: Red Hat Quay 3.12.20
Severity
Important
Notes
Topic: Red Hat Quay 3.12.20 is now available with bug fixes.
Details: Quay 3.12.20
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
5.2 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.
8.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.
7.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
References
173 references
Acknowledgments
Antony Di Scala
Michael Whale
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.12.20 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.12.20",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:43052",
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12143",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44486",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44487",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44488",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44492",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44494",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44495",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45822",
"url": "https://access.redhat.com/security/cve/CVE-2026-45822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43052.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.12.20",
"tracking": {
"current_release_date": "2026-07-25T19:05:53+00:00",
"generator": {
"date": "2026-07-25T19:05:53+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:43052",
"initial_release_date": "2026-07-21T22:47:21+00:00",
"revision_history": [
{
"date": "2026-07-21T22:47:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-21T22:47:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-25T19:05:53+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.12",
"product": {
"name": "Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.12::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784356439"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ac3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1784355382"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Adc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784353500"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3Aeeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1784358506"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ad8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Adc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aa661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Ac766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Afe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Aaec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Ae74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:30.944384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "RHBZ#2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"
}
],
"release_date": "2026-06-11T15:39:07.714000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:34.091476+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487948"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "RHBZ#2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v",
"url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"
}
],
"release_date": "2026-06-11T15:38:25.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via redirect flows"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T17:01:36.836488+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Denial of Service due to unenforced request and response size limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "RHBZ#2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"
}
],
"release_date": "2026-06-11T15:37:38.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Denial of Service due to unenforced request and response size limits"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-06-11T17:00:56.761751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487938"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "RHBZ#2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"release_date": "2026-06-11T15:29:13.890000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:01:12.945664+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "RHBZ#2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"
}
],
"release_date": "2026-06-11T15:32:03.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution"
},
{
"cve": "CVE-2026-44495",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:00:53.999811+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Axios, a promise-based HTTP client, can lead to information disclosure, including credential theft and response hijacking, or denial of service. Exploitation requires a separate prototype pollution vulnerability in the same JavaScript process, allowing an attacker to control `Object.prototype.transformResponse`. Red Hat products using affected Axios versions are at risk if another component introduces such pollution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "RHBZ#2487937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"
}
],
"release_date": "2026-06-11T15:33:12.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure due to prototype pollution vulnerability"
},
{
"cve": "CVE-2026-44990",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-12T21:02:24.911971+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "RHBZ#2488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
}
],
"release_date": "2026-06-12T20:39:47.065000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
},
{
"cve": "CVE-2026-45822",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-30T09:01:06.468966+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494807"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA\u0027s CVSS 4.0 assessment of 6.6 Medium.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45822"
},
{
"category": "external",
"summary": "RHBZ#2494807",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494807"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822"
},
{
"category": "external",
"summary": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js",
"url": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js"
},
{
"category": "external",
"summary": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
"url": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/decode-uri-component",
"url": "https://www.npmjs.com/package/decode-uri-component"
}
],
"release_date": "2026-06-30T08:05:36.399000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Validate and limit the length of any user-controlled input before passing it to decode-uri-component\u0027s decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. \u0027%ab\u0027 sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "decode-uri-component: decode-uri-component: Denial of Service via crafted input"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
}
]
}
ubuntu-cve-2026-44492
Vulnerability from osv_ubuntu
Published
2026-06-11 17:16
Modified
2026-06-30 16:21
Summary
Details
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Severity
8.6 (High)
8.6 (High)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-axios",
"binary_version": "0.19.0+dfsg-2"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "node-axios",
"purl": "pkg:deb/ubuntu/node-axios@0.19.0+dfsg-2?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.19.0+dfsg-2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-axios",
"binary_version": "0.26.0+dfsg-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "node-axios",
"purl": "pkg:deb/ubuntu/node-axios@0.26.0+dfsg-1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.21.1+dfsg-1",
"0.23.0+dfsg-2",
"0.24.0+dfsg-1",
"0.25.0+dfsg-2",
"0.26.0+dfsg-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-axios",
"binary_version": "1.6.8+dfsg-2"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "node-axios",
"purl": "pkg:deb/ubuntu/node-axios@1.6.8+dfsg-2?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.2.1+dfsg-1",
"1.5.1+dfsg-1",
"1.6.2+dfsg-1",
"1.6.8+dfsg-2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-axios",
"binary_version": "1.11.0+dfsg-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "node-axios",
"purl": "pkg:deb/ubuntu/node-axios@1.11.0+dfsg-1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.7.9+dfsg-1",
"1.8.4+dfsg-1",
"1.11.0+dfsg-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-axios",
"binary_version": "1.13.2+dfsg-1build1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "node-axios",
"purl": "pkg:deb/ubuntu/node-axios@1.13.2+dfsg-1build1?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.11.0+dfsg-1",
"1.12.1+dfsg-1",
"1.13.2+dfsg-1build1"
]
}
],
"aliases": [],
"details": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.",
"id": "UBUNTU-CVE-2026-44492",
"modified": "2026-06-30T16:21:56Z",
"published": "2026-06-11T17:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-44492"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"type": "REPORT",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-44492"
]
}
WID-SEC-W-2026-1955
Vulnerability from csaf_certbund - Published: 2026-06-16 22:00 - Updated: 2026-07-01 22:00Summary
Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.
Bitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.
Confluence ist eine kommerzielle Wiki-Software.
Fisheye ist ein Quellcode-Repository-Browser für Unternehmensteams.
Crucible ist eine Code-Review-Lösung für Unternehmensteams.
Jira ist eine Webanwendung zur Softwareentwicklung.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
Betroffene Betriebssysteme: - Sonstiges
- UNIX
- Windows
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
Affected products
Known affected
14 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Atlassian Crucible <4.9.11
Atlassian / Crucible
|
<4.9.11 | ||
|
Atlassian Fisheye <4.9.11
Atlassian / Fisheye
|
<4.9.11 | ||
|
Atlassian Confluence Data Center <9.2.21
Atlassian / Confluence
|
Data Center <9.2.21 | ||
|
Atlassian Confluence Data Center <10.2.13
Atlassian / Confluence
|
Data Center <10.2.13 | ||
|
Atlassian Bitbucket Data Center <10.3.1
Atlassian / Bitbucket
|
Data Center <10.3.1 | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Atlassian Bitbucket Data Center <9.4.21
Atlassian / Bitbucket
|
Data Center <9.4.21 | ||
|
Atlassian Bitbucket Data Center <10.2.4
Atlassian / Bitbucket
|
Data Center <10.2.4 | ||
|
Atlassian Jira Service Management Data Center and Server <10.3.22
Atlassian / Jira
|
Service Management Data Center and Server <10.3.22 | ||
|
Atlassian Jira Service Management Data Center and Server <11.3.7
Atlassian / Jira
|
Service Management Data Center and Server <11.3.7 | ||
|
Atlassian Bamboo Data Center <12.1.8
Atlassian / Bamboo
|
Data Center <12.1.8 | ||
|
Atlassian Jira Data Center <10.3.22
Atlassian / Jira
|
Data Center <10.3.22 | ||
|
Atlassian Jira Data Center <11.3.7
Atlassian / Jira
|
Data Center <11.3.7 | ||
|
Atlassian Bamboo Data Center <10.2.20
Atlassian / Bamboo
|
Data Center <10.2.20 |
References
18 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.\r\nBitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.\r\nConfluence ist eine kommerzielle Wiki-Software.\r\nFisheye ist ein Quellcode-Repository-Browser f\u00fcr Unternehmensteams. \r\nCrucible ist eine Code-Review-L\u00f6sung f\u00fcr Unternehmensteams.\r\nJira ist eine Webanwendung zur Softwareentwicklung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuf\u00fchren, erweiterte Berechtigungen zu erlangen, Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszul\u00f6sen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1955 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1955.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1955 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1955"
},
{
"category": "external",
"summary": "Atlassian Security Bulletin Juni vom 2026-06-16",
"url": "https://confluence.atlassian.com/security/security-bulletin-june-16-2026-1796309326.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:22380 vom 2026-06-18",
"url": "https://access.redhat.com/errata/RHSA-2026:22380"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:27171 vom 2026-06-19",
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:7634 vom 2026-06-18",
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:29197 vom 2026-06-24",
"url": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:30076 vom 2026-06-25",
"url": "https://access.redhat.com/errata/RHSA-2026:30076"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:30651 vom 2026-06-28",
"url": "https://access.redhat.com/errata/RHSA-2026:30651"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:30650 vom 2026-06-28",
"url": "https://access.redhat.com/errata/RHSA-2026:30650"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:33155 vom 2026-06-29",
"url": "https://access.redhat.com/errata/RHSA-2026:33155"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:33160 vom 2026-06-29",
"url": "https://access.redhat.com/errata/RHSA-2026:33160"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:33183 vom 2026-06-29",
"url": "https://access.redhat.com/errata/RHSA-2026:33183"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:33173 vom 2026-06-30",
"url": "https://access.redhat.com/errata/RHSA-2026:33173"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:33163 vom 2026-06-29",
"url": "https://access.redhat.com/errata/RHSA-2026:33163"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:33005 vom 2026-06-29",
"url": "https://access.redhat.com/errata/RHSA-2026:33005"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:34374 vom 2026-07-01",
"url": "https://access.redhat.com/errata/RHSA-2026:34374"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:28964 vom 2026-07-02",
"url": "https://access.redhat.com/errata/RHSA-2026:28964"
}
],
"source_lang": "en-US",
"title": "Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-07-01T22:00:00.000+00:00",
"generator": {
"date": "2026-07-02T09:24:21.483+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1955",
"initial_release_date": "2026-06-16T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-06-16T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-06-17T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-18T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-24T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-25T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-28T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-29T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-01T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "Data Center \u003c12.1.8",
"product": {
"name": "Atlassian Bamboo Data Center \u003c12.1.8",
"product_id": "T055489"
}
},
{
"category": "product_version",
"name": "Data Center 12.1.8",
"product": {
"name": "Atlassian Bamboo Data Center 12.1.8",
"product_id": "T055489-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:bamboo:data_center__12.1.8"
}
}
},
{
"category": "product_version_range",
"name": "Data Center \u003c10.2.20",
"product": {
"name": "Atlassian Bamboo Data Center \u003c10.2.20",
"product_id": "T055490"
}
},
{
"category": "product_version",
"name": "Data Center 10.2.20",
"product": {
"name": "Atlassian Bamboo Data Center 10.2.20",
"product_id": "T055490-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:bamboo:data_center__10.2.20"
}
}
}
],
"category": "product_name",
"name": "Bamboo"
},
{
"branches": [
{
"category": "product_version_range",
"name": "Data Center \u003c10.2.4",
"product": {
"name": "Atlassian Bitbucket Data Center \u003c10.2.4",
"product_id": "T055492"
}
},
{
"category": "product_version",
"name": "Data Center 10.2.4",
"product": {
"name": "Atlassian Bitbucket Data Center 10.2.4",
"product_id": "T055492-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:bitbucket:data_center__10.2.4"
}
}
},
{
"category": "product_version_range",
"name": "Data Center \u003c9.4.21",
"product": {
"name": "Atlassian Bitbucket Data Center \u003c9.4.21",
"product_id": "T055493"
}
},
{
"category": "product_version",
"name": "Data Center 9.4.21",
"product": {
"name": "Atlassian Bitbucket Data Center 9.4.21",
"product_id": "T055493-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:bitbucket:data_center__9.4.21"
}
}
},
{
"category": "product_version_range",
"name": "Data Center \u003c10.3.1",
"product": {
"name": "Atlassian Bitbucket Data Center \u003c10.3.1",
"product_id": "T055494"
}
},
{
"category": "product_version",
"name": "Data Center 10.3.1",
"product": {
"name": "Atlassian Bitbucket Data Center 10.3.1",
"product_id": "T055494-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:bitbucket:data_center__10.3.1"
}
}
}
],
"category": "product_name",
"name": "Bitbucket"
},
{
"branches": [
{
"category": "product_version_range",
"name": "Data Center \u003c10.2.13",
"product": {
"name": "Atlassian Confluence Data Center \u003c10.2.13",
"product_id": "T055495"
}
},
{
"category": "product_version",
"name": "Data Center 10.2.13",
"product": {
"name": "Atlassian Confluence Data Center 10.2.13",
"product_id": "T055495-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:confluence:data_center__10.2.13"
}
}
},
{
"category": "product_version_range",
"name": "Data Center \u003c9.2.21",
"product": {
"name": "Atlassian Confluence Data Center \u003c9.2.21",
"product_id": "T055496"
}
},
{
"category": "product_version",
"name": "Data Center 9.2.21",
"product": {
"name": "Atlassian Confluence Data Center 9.2.21",
"product_id": "T055496-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:confluence:data_center__9.2.21"
}
}
}
],
"category": "product_name",
"name": "Confluence"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c4.9.11",
"product": {
"name": "Atlassian Crucible \u003c4.9.11",
"product_id": "T055498"
}
},
{
"category": "product_version",
"name": "4.9.11",
"product": {
"name": "Atlassian Crucible 4.9.11",
"product_id": "T055498-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:crucible:4.9.11"
}
}
}
],
"category": "product_name",
"name": "Crucible"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c4.9.11",
"product": {
"name": "Atlassian Fisheye \u003c4.9.11",
"product_id": "T055497"
}
},
{
"category": "product_version",
"name": "4.9.11",
"product": {
"name": "Atlassian Fisheye 4.9.11",
"product_id": "T055497-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:fisheye:4.9.11"
}
}
}
],
"category": "product_name",
"name": "Fisheye"
},
{
"branches": [
{
"category": "product_version_range",
"name": "Data Center \u003c11.3.7",
"product": {
"name": "Atlassian Jira Data Center \u003c11.3.7",
"product_id": "T055499"
}
},
{
"category": "product_version",
"name": "Data Center 11.3.7",
"product": {
"name": "Atlassian Jira Data Center 11.3.7",
"product_id": "T055499-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:jira:data_center__11.3.7"
}
}
},
{
"category": "product_version_range",
"name": "Data Center \u003c10.3.22",
"product": {
"name": "Atlassian Jira Data Center \u003c10.3.22",
"product_id": "T055500"
}
},
{
"category": "product_version",
"name": "Data Center 10.3.22",
"product": {
"name": "Atlassian Jira Data Center 10.3.22",
"product_id": "T055500-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:jira:data_center__10.3.22"
}
}
},
{
"category": "product_version_range",
"name": "Service Management Data Center and Server \u003c11.3.7",
"product": {
"name": "Atlassian Jira Service Management Data Center and Server \u003c11.3.7",
"product_id": "T055501"
}
},
{
"category": "product_version",
"name": "Service Management Data Center and Server 11.3.7",
"product": {
"name": "Atlassian Jira Service Management Data Center and Server 11.3.7",
"product_id": "T055501-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:jira:service_management_data_center_and_server__11.3.7"
}
}
},
{
"category": "product_version_range",
"name": "Service Management Data Center and Server \u003c10.3.22",
"product": {
"name": "Atlassian Jira Service Management Data Center and Server \u003c10.3.22",
"product_id": "T055502"
}
},
{
"category": "product_version",
"name": "Service Management Data Center and Server 10.3.22",
"product": {
"name": "Atlassian Jira Service Management Data Center and Server 10.3.22",
"product_id": "T055502-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:atlassian:jira:service_management_data_center_and_server__10.3.22"
}
}
}
],
"category": "product_name",
"name": "Jira"
}
],
"category": "vendor",
"name": "Atlassian"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-11272",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2019-11272"
},
{
"cve": "CVE-2021-3803",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2021-3803"
},
{
"cve": "CVE-2022-1471",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2022-1471"
},
{
"cve": "CVE-2022-22965",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2022-22965"
},
{
"cve": "CVE-2022-22978",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2022-22978"
},
{
"cve": "CVE-2022-31692",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2022-31692"
},
{
"cve": "CVE-2024-22257",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2024-22257"
},
{
"cve": "CVE-2025-22228",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2025-22228"
},
{
"cve": "CVE-2026-22732",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-22732"
},
{
"cve": "CVE-2026-24734",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-24734"
},
{
"cve": "CVE-2026-26996",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-26996"
},
{
"cve": "CVE-2026-27903",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-27903"
},
{
"cve": "CVE-2026-27904",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-27904"
},
{
"cve": "CVE-2026-29129",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-29129"
},
{
"cve": "CVE-2026-33870",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-33870"
},
{
"cve": "CVE-2026-33871",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-33871"
},
{
"cve": "CVE-2026-34077",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-34077"
},
{
"cve": "CVE-2026-34486",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-34486"
},
{
"cve": "CVE-2026-34487",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-34487"
},
{
"cve": "CVE-2026-40175",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-40175"
},
{
"cve": "CVE-2026-41044",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-41044"
},
{
"cve": "CVE-2026-41284",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-41284"
},
{
"cve": "CVE-2026-41293",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-41293"
},
{
"cve": "CVE-2026-42033",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42033"
},
{
"cve": "CVE-2026-42035",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42035"
},
{
"cve": "CVE-2026-42038",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42038"
},
{
"cve": "CVE-2026-42043",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42043"
},
{
"cve": "CVE-2026-42198",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42198"
},
{
"cve": "CVE-2026-42211",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42211"
},
{
"cve": "CVE-2026-42264",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42264"
},
{
"cve": "CVE-2026-42342",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42342"
},
{
"cve": "CVE-2026-42498",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42498"
},
{
"cve": "CVE-2026-42579",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42579"
},
{
"cve": "CVE-2026-42581",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42581"
},
{
"cve": "CVE-2026-42583",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42583"
},
{
"cve": "CVE-2026-42584",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42584"
},
{
"cve": "CVE-2026-42585",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42585"
},
{
"cve": "CVE-2026-42587",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-43512",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-43512"
},
{
"cve": "CVE-2026-43513",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-43513"
},
{
"cve": "CVE-2026-43515",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-43515"
},
{
"cve": "CVE-2026-44486",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-44486"
},
{
"cve": "CVE-2026-44487",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-44487"
},
{
"cve": "CVE-2026-44488",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-44488"
},
{
"cve": "CVE-2026-44492",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-44492"
},
{
"cve": "CVE-2026-44495",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-44495"
},
{
"cve": "CVE-2026-44496",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-44496"
},
{
"cve": "CVE-2026-45149",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-45149"
},
{
"cve": "CVE-2026-45736",
"product_status": {
"known_affected": [
"T055498",
"T055497",
"T055496",
"T055495",
"T055494",
"67646",
"T055493",
"T055492",
"T055502",
"T055501",
"T055489",
"T055500",
"T055499",
"T055490"
]
},
"release_date": "2026-06-16T22:00:00.000+00:00",
"title": "CVE-2026-45736"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…